We used to run Samba binaries without minijail preload librart. CL:427705 fixed that. Now seccomp filters can be made more stringent since less code runs inside seccomp.

The following syscalls are candidates for removal (from an early test). Be careful not to introduce regression, though!

- arch_prctl
- brk
- execve
- getrlimit
- mprotect
- stat
- rt_sigaction
- rt_sigprocmask
- set_robust_list
- set_tid_address