CI: add mprotect to the whitelist syscalls

Upon exec, a mprotect call is triggered. Since
this syscall is not whitelisted the CI would fail
with "Bad System Call". This is needed only in the CI.

Signed-off-by: Diana Popa <[email protected]>

Author: dianpopa

tests/integration_tests/security/demo_seccomp/src/bin/demo_malicious.rs

@@ -2,7 +2,7 @@
 // SPDX-License-Identifier: Apache-2.0
 fn main() {
     unsafe {
-        // In this example, the malicious component is outputing to standard input.
+        // In this example, the malicious component is outputting to standard input.
         libc::syscall(libc::SYS_write, libc::STDIN_FILENO, "Hello, world!\n", 14);
     }
 }

tests/integration_tests/security/demo_seccomp/src/bin/seccomp_rules/mod.rs

@@ -18,6 +18,7 @@ pub fn jailer_required_rules() -> Vec<SyscallRuleSet> {
         allow_syscall(libc::SYS_rt_sigaction),
         allow_syscall(libc::SYS_execve),
         allow_syscall(libc::SYS_mmap),
+        allow_syscall(libc::SYS_mprotect),
         #[cfg(target_arch = "x86_64")]
         allow_syscall(libc::SYS_arch_prctl),
         allow_syscall(libc::SYS_set_tid_address),