[7.16](backport #28117) Allow clone3 syscall in seccomp filters (#28330)

* seccomp: allow clone3 syscall for x86 (#28117)

clone3 is a linux syscall that is now used by glibc starting version
2.34. It is used when pthread_create() gets called. Current seccomp
filters do not allow this syscall leading to crashes like
runtime/cgo: pthread_create failed: Operation not permitted

See elastic/apm-server#6238 for more details

(cherry picked from commit 82507fd)

Co-authored-by: Arnaud Lefebvre <a.lefebvre@outlook.fr>
Co-authored-by: Jaime Soriano Pastor <jaime.soriano@elastic.co>

CHANGELOG.next.asciidoc

@@ -94,6 +94,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - Fix discovery of Nomad allocations with multiple events during startup. {pull}28700[28700]
 - Allows disable pod events enrichment with deployment name {pull}28521[28521]
 - Fix `fingerprint` processor to give it access to the `@timestamp` field. {issue}28683[28683]
+- Allow `clone3` syscall in seccomp filters. {pull}28117[28117]
 - Fix the wrong beat name on monitoring and state endpoint {issue}27755[27755]
 - Skip configuration checks in autodiscover for configurations that are already running {pull}29048[29048]
 - Fix `decode_json_processor` to always respect `add_error_key` {pull}29107[29107]

libbeat/common/seccomp/policy_linux_386.go

@@ -35,6 +35,7 @@ func init() {
  "chown",
  "clock_gettime",
  "clone",
+ "clone3",
  "close",
  "dup",
  "dup2",

libbeat/common/seccomp/policy_linux_amd64.go

@@ -38,6 +38,7 @@ func init() {
  "chown",
  "clock_gettime",
  "clone",
+ "clone3",
  "close",
  "connect",
  "dup",