Add syscall sandboxing (seccomp-bpf)

src/mapport.cpp

@@ -14,6 +14,7 @@
 #include <netaddress.h>
 #include <netbase.h>
 #include <threadinterrupt.h>
+#include <util/syscall_sandbox.h>
 #include <util/system.h>
 #include <util/thread.h>
 
@@ -222,6 +223,7 @@ static bool ProcessUpnp()
 
 static void ThreadMapPort()
 {
+    SetSyscallSandboxPolicy(SyscallSandboxPolicy::INITIALIZATION_MAP_PORT);
     bool ok;
     do {
         ok = false;