libstore: move setupSyscallFilter to linux platform bits

setting them that little bit later really doesn't hurt us at all.

Change-Id: I6b50fbe0b58d037de729748cb4f87dd628bd111b

lix/libstore/build/local-derivation-goal.cc

@@ -1127,8 +1127,6 @@ void LocalDerivationGoal::runChild()
 
         commonExecveingChildInit();
 
-        setupSyscallFilter();
-
         /* Make the contents of netrc and the CA certificate bundle
            available to builtin:fetchurl (which may run under a
            different uid and/or in a sandbox). */

lix/libstore/build/local-derivation-goal.hh

@@ -316,12 +316,6 @@ protected:
     kj::Promise<Result<WorkResult>> handleRawChild() noexcept;
     kj::Promise<Result<std::optional<WorkResult>>> handleRawChildStream() noexcept;
 
-    /**
-     * Set up the system call filtering required for the sandbox.
-     * This currently only has an effect on Linux.
-     */
-    virtual void setupSyscallFilter() {}
-
     /**
      * Prepare the sandbox. Currently only used on linux to build the sandbox namespace,
      * write configuration files inside it, and to set up networking with pasta enabled.

lix/libstore/platform/linux.cc

@@ -907,6 +907,8 @@ std::string LinuxLocalDerivationGoal::rewriteResolvConf(std::string fromHost)
 
 bool LinuxLocalDerivationGoal::prepareChildSetup()
 {
+    setupSyscallFilter();
+
     if (!useChroot) {
         return true;
     }

lix/libstore/platform/linux.hh

@@ -84,7 +84,7 @@ private:
      * Set up system call filtering using seccomp, unless disabled at build time.
      * This also sets the NO_NEW_PRIVS flag.
      */
-    void setupSyscallFilter() override;
+    void setupSyscallFilter();
 
     bool supportsUidRange() override
     {