Add clone3 to seccomp profile syscalls

[aledbf]

Related Issue(s)

Fixes #10703
Fixes #11963
Fixes #11964

How to test

• Open a workspace and run

git clone https://github.com/ComplianceAsCode/content/
cd content/Dockerfiles
docker build -t test -f ubuntu .

• Test command docker run -it gitpod/workspace-full:latest bash do not ends with SIGABRT

Release Notes

NONE

Werft options:

• /werft with-preview

[werft-gitpod-dev-com]

started the job as gitpod-build-aledbf-clone3.1 because the annotations in the pull request description changed
(with .werft/ from main)

[utam0k]

/hold until getting approval from @utam0k and @Furisto because this PR affects security aside. Of course, welcome comments from others.

[utam0k]

As for the namespace, we still allow clone(2) / unshare, so it is probably not a problem. The problem is CLONE_INTO_CGROUP. But it seems that it is only used in the cgroup v2, and we are separating the host cgroup namespace from the user workspace cgroup namespace. So there are is no problem to allow clone3

[utam0k]

@Furisto If you put into approve this PR, feel free /unhold.

[kylos101]

@Furisto @utam0k does this need to be tested with cgroup v1? I ask for self-hosted customers.

[Furisto]

@kylos101 We do not need to test it for cgroup v1.

[Furisto]

/unhold

[utam0k]

@Furisto @utam0k does this need to be tested with cgroup v1? I ask for self-hosted customers.

We don't need it because it relates seccomp notify feature, not cgroup 👍