seccomp: always propagate NO_NEW_PRIVS on tsync

[ Upstream commit 103502a35cfce0710909da874f092cb44823ca03 ]

Before this patch, a process with some permissive seccomp filter
that was applied by root without NO_NEW_PRIVS was able to add
more filters to itself without setting NO_NEW_PRIVS by setting
the new filter from a throwaway thread with NO_NEW_PRIVS.

Signed-off-by: Jann Horn <jann@thejh.net>
Cc: stable@vger.kernel.org
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
(cherry picked from commit 4702c50cfaecb5a4daa40b6d2b10983b8f2fc8e6)
Change-Id: Id07711c9a2630b6eb431b0ead3f22d825461be52
Signed-off-by: Chetan C R <cravin@codeaurora.org>