Use seccomp's add_rule_conditional

Currently, if we need to hook, say, ioctl request 42, all ioctl requests are trapped to user space, because we use seccomp's `add_rule` method, like `add_rule(ioctl)`.

We can do better. If we use seccomp's `add_rule_conditional` method instead, like `add_rule_conditional(ioctl, arg2 == 42)`, only ioctl request 42 is trapped to user space, because comparison check is done in kernel space. This may improve performance.