Remove unused syscalls from filters

mlock gone in Go 1.16 in https://golang.org/cl/246200.
The Go runtime (on amd64) switches from using arch_prctl(ARCH_SET_FS)
to CLONE_SETTLS to set the TLS.

PiperOrigin-RevId: 419935904

runsc/boot/filter/config.go

@@ -183,18 +183,6 @@ var allowedSyscalls = seccomp.SyscallRules{
 		},
 	},
 	unix.SYS_MINCORE: {},
-	// Used by the Go runtime as a temporarily workaround for a Linux
-	// 5.2-5.4 bug.
-	//
-	// See src/runtime/os_linux_x86.go.
-	//
-	// TODO(b/148688965): Remove once this is gone from Go.
-	unix.SYS_MLOCK: []seccomp.Rule{
-		{
-			seccomp.MatchAny{},
-			seccomp.EqualTo(4096),
-		},
-	},
 	unix.SYS_MMAP: []seccomp.Rule{
 		{
 			seccomp.MatchAny{},

runsc/boot/filter/config_amd64.go

@@ -19,16 +19,10 @@ package filter
 
 import (
 	"golang.org/x/sys/unix"
-	"gvisor.dev/gvisor/pkg/abi/linux"
 	"gvisor.dev/gvisor/pkg/seccomp"
 )
 
 func init() {
-	allowedSyscalls[unix.SYS_ARCH_PRCTL] = []seccomp.Rule{
-		// TODO(b/168828518): No longer used in Go 1.16+.
-		{seccomp.EqualTo(linux.ARCH_SET_FS)},
-	}
-
 	allowedSyscalls[unix.SYS_CLONE] = []seccomp.Rule{
 		// parent_tidptr and child_tidptr are always 0 because neither
 		// CLONE_PARENT_SETTID nor CLONE_CHILD_SETTID are used.

runsc/fsgofer/filter/config.go

@@ -126,18 +126,6 @@ var allowedSyscalls = seccomp.SyscallRules{
 	unix.SYS_MEMFD_CREATE: {}, /// Used by flipcall.PacketWindowAllocator.Init().
 	unix.SYS_MKDIRAT:      {},
 	unix.SYS_MKNODAT:      {},
-	// Used by the Go runtime as a temporarily workaround for a Linux
-	// 5.2-5.4 bug.
-	//
-	// See src/runtime/os_linux_x86.go.
-	//
-	// TODO(b/148688965): Remove once this is gone from Go.
-	unix.SYS_MLOCK: []seccomp.Rule{
-		{
-			seccomp.MatchAny{},
-			seccomp.EqualTo(4096),
-		},
-	},
 	unix.SYS_MMAP: []seccomp.Rule{
 		{
 			seccomp.MatchAny{},