Auditbeat alerts seccomp policy violation in default system with no outside access

[Paladin]

Please post all questions and issues on https://discuss.elastic.co/c/beats
before opening a Github Issue. Your questions will reach a wider audience there,
and if we confirm that there is a bug, then you can open a new issue.

For security vulnerabilities please only send reports to security@elastic.co.
See https://www.elastic.co/community/security for more information.

Please include configurations and logs if available.

For confirmed bugs, please report:

• Version: 6.8
• Operating System: CentOS 7.6.1810
• Discuss Forum URL: https://discuss.elastic.co/t/auditbeat-triggers-seccomp-violations/185700
• Steps to Reproduce: All I needed to do was install auditbeat and turn it on. Changing the audit
  rules did not seem to stop the alerts happening

[ph]

cc @andrewkroh since you were involved on the discuss thread and you know our seccomp implementation.

[andrewkroh]

It's the system/package metricset which utilizes librpm on RedHat systems.

It's making two system calls that are not allowed -- umask and mremap.

[andrewkroh]

PR to edit the policy for Auditbeat only: #12617