seccomp: kernel 5.14 (quotactl_fd, memfd_secret)

- Allow `quotactl_fd` when `CAP_SYS_ADMIN` is granted.
  See https://lwn.net/Articles/859679/

- Allow `memfd_secret` by default.
  See https://lwn.net/Articles/865256/

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>

contrib/seccomp/seccomp_default.go

@@ -204,6 +204,7 @@ func DefaultProfile(sp *specs.Spec) *specs.LinuxSeccomp {
 				"madvise",
 				"membarrier",
 				"memfd_create",
+				"memfd_secret",
 				"mincore",
 				"mkdir",
 				"mkdirat",
@@ -546,6 +547,7 @@ func DefaultProfile(sp *specs.Spec) *specs.LinuxSeccomp {
 					"open_tree",
 					"perf_event_open",
 					"quotactl",
+					"quotactl_fd",
 					"setdomainname",
 					"sethostname",
 					"setns",