seccomp: move brk+mmap+mmap2 into @default syscall filter set

These three syscalls are internally used by libc's memory allocation
logic, i.e. ultimately back malloc(). Allocating a bit of memory is so
basic, it should just be in the default set.

This fixes a couple of issues with asan/msan and the seccomp tests: when
asan/msan is used some additional, large memory allocations take place
in the background, and unless mmap/mmap2/brk are allowlisted these will
fail, aborting the test prematurely.

man/resolved.conf.xml

@@ -233,13 +233,11 @@
         resolver is not capable of authenticating the server, so it is
         vulnerable to "man-in-the-middle" attacks.</para>
 
-        <para>In addition to this global DNSOverTLS setting
+        <para>In addition to this global <varname>DNSOverTLS=</varname> setting
         <citerefentry><refentrytitle>systemd-networkd.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>
-        also maintains per-link DNSOverTLS settings. For system DNS
+        also maintains per-link <varname>DNSOverTLS=</varname> settings. For system DNS servers (see above), only the global
-        servers (see above), only the global DNSOverTLS setting is in
+        <varname>DNSOverTLS=</varname> setting is in effect. For per-link DNS servers the per-link setting is in effect, unless
-        effect. For per-link DNS servers the per-link
+        it is unset in which case the global setting is used instead.</para>
-        setting is in effect, unless it is unset in which case the
-        global setting is used instead.</para>
 
         <para>Defaults to off.</para>
         </listitem>

src/shared/seccomp-util.c

@@ -282,6 +282,7 @@ const SyscallFilterSet syscall_filter_sets[_SYSCALL_FILTER_SET_MAX] = {
                 .name = "@default",
                 .help = "System calls that are always permitted",
                 .value =
+                "brk\0"
                 "cacheflush\0"
                 "clock_getres\0"
                 "clock_getres_time64\0"
@@ -319,6 +320,8 @@ const SyscallFilterSet syscall_filter_sets[_SYSCALL_FILTER_SET_MAX] = {
                 "getuid\0"
                 "getuid32\0"
                 "membarrier\0"
+                "mmap\0"
+                "mmap2\0"
                 "nanosleep\0"
                 "pause\0"
                 "prlimit64\0"
@@ -468,8 +471,6 @@ const SyscallFilterSet syscall_filter_sets[_SYSCALL_FILTER_SET_MAX] = {
                 "mkdirat\0"
                 "mknod\0"
                 "mknodat\0"
-                "mmap\0"
-                "mmap2\0"
                 "munmap\0"
                 "newfstatat\0"
                 "oldfstat\0"
@@ -844,7 +845,6 @@ const SyscallFilterSet syscall_filter_sets[_SYSCALL_FILTER_SET_MAX] = {
                 "@signal\0"
                 "@sync\0"
                 "@timer\0"
-                "brk\0"
                 "capget\0"
                 "capset\0"
                 "copy_file_range\0"

units/modprobe@.service

@@ -13,7 +13,6 @@ DefaultDependencies=no
 Before=sysinit.target
 Documentation=man:modprobe(8)
 ConditionCapability=CAP_SYS_MODULE
-ConditionPathExists=!/sys/module/%I
 
 [Service]
 Type=oneshot

units/sys-fs-fuse-connections.mount

@@ -12,12 +12,18 @@ Description=FUSE Control File System
 Documentation=https://www.kernel.org/doc/Documentation/filesystems/fuse.txt
 Documentation=https://www.freedesktop.org/wiki/Software/systemd/APIFileSystems
 DefaultDependencies=no
-ConditionPathExists=/sys/fs/fuse/connections
 ConditionCapability=CAP_SYS_ADMIN
 ConditionVirtualization=!private-users
-After=systemd-modules-load.service
 Before=sysinit.target
 
+# These dependencies are used to make certain that the module is fully
+# loaded. Indeed udev starts this unit when it receives an uevent for the
+# module but the kernel sends it too early, ie before the init() of the module
+# is fully operational and /sys/fs/fuse/connections is created, see issue#17586.
+
+After=modprobe@fuse.service
+Requires=modprobe@fuse.service
+
 [Mount]
 What=fusectl
 Where=/sys/fs/fuse/connections

units/sys-kernel-config.mount

@@ -12,11 +12,17 @@ Description=Kernel Configuration File System
 Documentation=https://www.kernel.org/doc/Documentation/filesystems/configfs/configfs.txt
 Documentation=https://www.freedesktop.org/wiki/Software/systemd/APIFileSystems
 DefaultDependencies=no
-ConditionPathExists=/sys/kernel/config
 ConditionCapability=CAP_SYS_RAWIO
-After=systemd-modules-load.service
 Before=sysinit.target
 
+# These dependencies are used to make certain that the module is fully
+# loaded. Indeed udev starts this unit when it receives an uevent for the
+# module but the kernel sends it too early, ie before the init() of the module
+# is fully operational and /sys/kernel/config is created, see issue#17586.
+
+After=modprobe@configfs.service
+Requires=modprobe@configfs.service
+
 [Mount]
 What=configfs
 Where=/sys/kernel/config