Would be better to call it right at the start of the watchdog.  If it fails, we know immediately and not when it is too late.  Also, prctl might not be signal-safe.