seccomp: block setns, unshare and execveat syscalls