background thread (might be internal only):
  https://groups.google.com/a/google.com/forum/#!topic/minijail-dev/7PldvHKbMfg

basically we should look at tooling to use libseccomp so we can write a single source filter for all arches and have it compile it at build time, then minijail would load it as a blob.