Use seccomp's add_rule_conditional

[lablup]

Use seccomp's add_rule_conditional

[sanxiyn]

Note on using libseccomp: if we want to trap ioctl request 42, but allow ioctl otherwise, we can't do add_rule_conditional(Trap, ioctl, arg2 == 42) then add_rule(Allow, ioctl). The later must be add_rule_conditional(Allow, ioctl, arg2 != 42) instead.

This is documented in seccomp_rule_add(3):

All of the filter rules supplied by the calling application are combined into a union, with additional logic to eliminate redundant syscall filters. For example, if a rule is added which allows a given syscall with a specific set of argument values and later a rule is added which allows the same syscall regardless the argument values then the first, more specific rule, is effectively dropped from the filter by the second more generic rule.