vmm: Clean up seccomp handling for glibc overcommit sysctl

Unfortunately glibc can read the overcommit sysctl from any thread. This
has lead to us adding a patchwork of openat/read syscalls to our allow
list when those threads don't necessarily need openat for their actual
uses.

Only the VMM and migration worker thread have a strict requirement for
the openat syscall. The syscall was added to the other threads to deal
with this glibc behaviour.

As read() is itself harmless move it to the common syscalls, strip
full openat() from all but the threads that need it and add limited,
read only, openat to all threads.

Signed-off-by: Rob Bradford <rbradford@meta.com>

virtio-devices/src/seccomp_filters.rs

@@ -8,7 +8,7 @@ use std::env;
 
 use block::{BLKDISCARD, BLKZEROOUT};
 use libc::{FIONBIO, TIOCGWINSZ, TUNSETOFFLOAD};
-use seccompiler::SeccompCmpOp::Eq;
+use seccompiler::SeccompCmpOp::{Eq, MaskedEq};
 use seccompiler::{
     BpfProgram, Error, SeccompAction, SeccompCmpArgLen as ArgLen, SeccompCondition as Cond,
     SeccompFilter, SeccompRule,
@@ -364,7 +364,18 @@ fn virtio_thread_common() -> Vec<(i64, Vec<SeccompRule>)> {
         (libc::SYS_mprotect, vec![]),
         (libc::SYS_mremap, vec![]),
         (libc::SYS_munmap, vec![]),
-        (libc::SYS_openat, vec![]),
+        (
+            libc::SYS_openat,
+            or![and![
+                Cond::new(
+                    2, // openat() flags argument
+                    ArgLen::Dword,
+                    MaskedEq(libc::O_ACCMODE as u64),
+                    libc::O_RDONLY as u64,
+                )
+                .unwrap()
+            ]],
+        ),
         (libc::SYS_read, vec![]),
         (libc::SYS_rt_sigprocmask, vec![]),
         (libc::SYS_rt_sigreturn, vec![]),