Some system calls can not be whitelisted

[pierretom]

For example:
441 - epoll_pwait2
449 - futex_waitv

seccomp.keep epoll_pwait2,futex_waitv,...
seccomp.log

Also those system calls do not appear with --debug-syscalls but are present in syscalls.list.

[rusty-snake]

The syscall lists and groups in firejail are seriously out of date by a few years. This affects the ability to name syscalls in seccomp.* (by number syntax could work) but also blacklisting of newer syscalls that provide a superset of an older blocked syscall.

If anyone wants to PR, here are the relevant files:

https://github.com/netblue30/firejail/blob/master/src/include/syscall_x86_64.h
https://github.com/netblue30/firejail/blob/master/src/include/syscall_i386.h
https://github.com/netblue30/firejail/blob/master/src/include/syscall_armeabi.h
https://github.com/netblue30/firejail/blob/master/src/include/syscall_aarch64.h

[pierretom]

Ok, work in progress.