interfaces: add default seccomp template

[zyga]

This patch copies the default seccomp template that applies to all applications
in all snaps. Since we're keeping all the interface implementations in go it is
easier and arguably more correct to also hold the base policy in the same
place.

Subsequent patches will use this template and incorporate interface-specific
security snippets into it.

Signed-off-by: Zygmunt Krynicki zygmunt.krynicki@canonical.com

[niemeyer]

Why are we copying this in? Isn't there a statement in the seccomp syntax to simply inherit from it?

[zyga]

I don't think seccomp has one. I'll check. My main motivation for having it baked-in is so that nothing form outside snappy is required to run with security (so we don't need to live in lockstep with ubuntu-core-security, we don't have to read it separately from a file, we don't have to invalidate it when it gets updated out-of-bound on the desktop, etc.).

[niemeyer]

Nevermind.. @jdstrand says this is probably the best way to go, so LGTM.

Please get the second review from @jdstrand himself.

[jdstrand]

The seccomp policy is the same as what we have in ubuntu-core-security/data/seccomp/templates/ubuntu-core/16.04/default. LGTM.