nspawn: mask socket() arguments to 32 bits in the NETLINK_AUDIT filter

The domain and protocol arguments of socket() are ints, but are passed
to the kernel in 64-bit registers, and the kernel truncates them to the
low 32 bits. The rule that makes socket(AF_NETLINK, *, NETLINK_AUDIT)
fail compared the full 64-bit registers with SCMP_CMP_EQ, so setting any
bit above bit 31 in either argument let an audit socket be created.

Use SCMP_CMP_MASKED_EQ with a 32-bit mask for both comparisons.

Follow-up for #44134

Signed-off-by: Ricardo Branco <rbranco@suse.de>
(cherry picked from commit 03e27922cae696af7a15b5375e1820e868284286)

src/nspawn/nspawn-seccomp.c

@@ -233,8 +233,8 @@ int setup_seccomp(
                                 SCMP_ACT_ERRNO(EAFNOSUPPORT),
                                 SCMP_SYS(socket),
                                 2,
-                                SCMP_A0(SCMP_CMP_EQ, AF_NETLINK),
-                                SCMP_A2(SCMP_CMP_EQ, NETLINK_AUDIT));
+                                SCMP_A0(SCMP_CMP_MASKED_EQ, UINT32_MAX, AF_NETLINK),
+                                SCMP_A2(SCMP_CMP_MASKED_EQ, UINT32_MAX, NETLINK_AUDIT));
                 if (r < 0) {
                         log_debug_errno(r, "Failed to add audit seccomp rule, ignoring: %m");
                         continue;