The new pkey_alloc(), pkey_mprotect() and pkey_free() syscalls have been added in the 4.8 kernel. Support needs to be added to the syscall tapset.
Some more information:
(Note that it probably makes sense to wait until bug #20333 is finished before doing this work.)
Support added for new pkey_* syscalls in commit e534cf2a727b4743760b1117d6e6b83f3cef404e