BUG: check direct syscall before multiplexed pseudo-syscall

[nikita-dubrovskii]

Docker 29.4.2 removed socketcall(2) from the default seccomp profile. On s390x, this broke socket operations:

  # strace curl icanhazip.com
  socket(AF_UNIX, SOCK_STREAM, 0) = -1 ENOSYS (Function not implemented)

  # scmp_sys_resolver -a s390x socket
  -101

  # ausyscall s390x socket
  socket             359

The abi_syscall_resolve_name_munge() function was returning __PNR_socket (-101) instead of checking if arch implements socket(2) directly (359).

Fix by checking arch->syscall_resolve_name_raw() first, only falling back to multiplexed pseudo-syscalls if the direct implementation doesn't exist.

Affects socket and IPC syscalls on architectures with direct implementations (s390x, aarch64, etc).

[nikita-dubrovskii]

This won't fix Docker itself, but at least the tools will return the correct values:

[zukku@a3elp43 libseccomp]$ scmp_sys_resolver socket
-101

$ LD_PRELOAD=./src/.libs/libseccomp.so scmp_sys_resolver socket
359

[pcmoore]

We need to be careful with changes like this as it is changing the behavior of the library in a way that might not be friendly to all of the users.

[pcmoore]

Marking this as a BUG for now, but until we understand the impact of a change like this we need to take the classification with a grain of salt ...