Tighten up the seccomp sandbox

Here are some improvements.  Hopefully they're compatible with everything.