Add clone3 to seccomp profile syscalls

[aledbf]

Related Issue(s)

Fixes #10703 Fixes #11963 Fixes #11964

How to test

• Open a workspace and run

git clone https://github.com/ComplianceAsCode/content/
cd content/Dockerfiles
docker build -t test -f ubuntu .

• Test command docker run -it gitpod/workspace-full:latest bash do not ends with SIGABRT

Release Notes

NONE

Werft options:

• [x] /werft with-preview

[werft-gitpod-dev-com[bot]]

started the job as gitpod-build-aledbf-clone3.1 because the annotations in the pull request description changed (with .werft/ from main)

[utam0k]

/hold until getting approval from @utam0k and @Furisto because this PR affects security aside. Of course, welcome comments from others.

[utam0k]

@Furisto If you put into approve this PR, feel free /unhold.

[kylos101]

@Furisto @utam0k does this need to be tested with cgroup v1? I ask for self-hosted customers.

[Furisto]

@kylos101 We do not need to test it for cgroup v1.

[Furisto]

/unhold

[utam0k]

@Furisto @utam0k does this need to be tested with cgroup v1? I ask for self-hosted customers.

We don't need it because it relates seccomp notify feature, not cgroup 👍