Permit the nanosleep system call in the seccomp2 callbox

Fixes bug 24969; bugfix on 0.2.5.1-alpha when the sandbox was introduced.

changes/bug24969

@@ -0,0 +1,3 @@
+  o Minor bugfixes (Linux seccomp2 sandbox):
+    - Allow the nanosleep() system call, which glibc uses to implement
+      sleep() and usleep(). Fixes bug 24969; bugfix on 0.2.5.1-alpha.

src/common/sandbox.c

@@ -185,6 +185,9 @@ static int filter_nopar_gen[] = {
     SCMP_SYS(mmap),
 #endif
     SCMP_SYS(munmap),
+#ifdef __NR_nanosleep
+    SCMP_SYS(nanosleep),
+#endif
 #ifdef __NR_prlimit
     SCMP_SYS(prlimit),
 #endif