Add system call filters for ASAN

Go supports integration with C ASAN now (for sanitizing cgo code). We need
filters similar to MSAN when built in this mode.

PiperOrigin-RevId: 522103320

runsc/boot/filter/BUILD

@@ -13,6 +13,7 @@ go_library(
         "config_arm64.go",
         "config_profile.go",
         "extra_filters.go",
+        "extra_filters_asan.go",
         "extra_filters_hostinet.go",
         "extra_filters_msan.go",
         "extra_filters_race.go",

runsc/boot/filter/extra_filters.go

@@ -12,8 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-//go:build !msan && !race
-// +build !msan,!race
+//go:build !asan && !msan && !race
 
 package filter
 

runsc/boot/filter/extra_filters_asan.go

@@ -0,0 +1,34 @@
+// Copyright 2023 The gVisor Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//go:build asan
+// +build asan
+
+package filter
+
+import (
+	"golang.org/x/sys/unix"
+	"gvisor.dev/gvisor/pkg/seccomp"
+)
+
+// instrumentationFilters returns additional filters for syscalls used by ASAN.
+func instrumentationFilters() seccomp.SyscallRules {
+	Report("ASAN is enabled: syscall filters less restrictive!")
+	return seccomp.SyscallRules{
+		unix.SYS_CLONE:             {},
+		unix.SYS_MMAP:              {},
+		unix.SYS_SCHED_GETAFFINITY: {},
+		unix.SYS_SET_ROBUST_LIST:   {},
+	}
+}