Allow using BATCH/IDLE scheduler classes in QM

[alexlarsson]

The current seccomp changes completely disallow calling sched_setscheduler, but we can safely allow calling it with policy==SCHED_OTHER/BATCH/IDLE, as really the only problem is the various real-time classes.

The profile argument is the second (id 1) and the values for the classes are OTHER=0, BATCH==3, IDLE==5, so the rule should look like:

{
	"names": [
		"sched_setscheduler"
	],
	"action": "SCMP_ACT_ERRNO",
	"args": [
		{
			"index": 1,
			"value": 0,
			"valueTwo": 0,
			"op": "SCMP_CMP_NE"
		},
		{
			"index": 1,
			"value": 3,
			"valueTwo": 0,
			"op": "SCMP_CMP_NE"
		},
		{
			"index": 1,
			"value": 5,
			"valueTwo": 0,
			"op": "SCMP_CMP_NE"
		}
	],
	"errnoRet": 1,
	"errno": "EPERM"
}

[alexlarsson]

Unfortunately we can't allow this with sched_setattr, because in that syscall the profile argument is not a separate syscall argument but is stored in the memory pointed to by the attr pointer argument.