Closes #43481

Add pkey_alloc(2), pkey_free(2) and pkey_mprotect(2) in seccomp default profile.
Similar to mprotect(), pkey_alloc(2), pkey_free(2) and pkey_mprotect(2) can only configure its own memory of the process, so they are existing "safe for everyone" syscalls.

Such syscalls were added to Linux in kernel 4.9
More details can be found in the man page

• What I did
  I add pkey_alloc(), pkey_free()andpkey_mprotect()` into the default syscall's white list.

• How I did it
  Modify profiles/seccomp/default.json and profiles/seccomp/default_linux.go, append pkey_alloc(), pkey_free() and pkey_mprotect() to the default syscall list.

• How to verify it

  Here is the sample code (test.c):

  #define _GNU_SOURCE
  #include <stdlib.h>
  #include <stdio.h>
  #include <sys/mman.h>
  #define BUF_SIZE    (0x1000)
  int main() {
      int ret = -1, pkey = -1;
      ret = pkey_alloc(0, 0);
      if (ret < 0) {
          perror("Cannot invoke pkey_alloc() successfully");
          exit(-1);
      } else {
          pkey = ret;
          char *buf = (char *)mmap(NULL, BUF_SIZE, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANON, -1, 0);
          if (buf == MAP_FAILED) {
              perror("Cannot invoke mmap() successfully");
              exit(-1);
          }
          ret = pkey_mprotect(buf, BUF_SIZE, PROT_READ | PROT_WRITE, pkey);
          if (ret < 0) {
              perror("Cannot invoke pkey_mprotect() successfully");
              exit(-1);
          }
          ret = munmap(buf, BUF_SIZE);
          if (ret < 0) {
              perror("Cannot invoke munmap() successfully");
              exit(-1);
          }
          ret = pkey_free(pkey);
          if (ret < 0) {
              perror("Cannot invoke pkey_free() successfully");
              exit(-1);
          }
      }
      printf("PKU related syscalls are allowed in container environment!\n");
      return 0;
  }
  

  Compile it first:

  gcc -o test test.c
  

  docker run -it -v ${PWD}:/root/test --security-opt seccomp=${PWD}/profiles/seccomp/default.json ubuntu::20.04
  

  Run test in docker:

  /root/test/test
  

  and will get the output:

  PKU related syscalls are allowed in container environment!
  

• Description for the changelog
  profiles/seccomp/default.json and profiles/seccomp/default_linux.go: Add pkey_alloc(), pkey_free() and pkey_mprotect() to the default white list.

• A picture of a cute animal (not mandatory but encouraged)