Use Chromium seccomp-bpf compiler to dynamically build sandbox program.
Allow tgkill only for threads of the calling process itself.
Fix socketcall whitelisting on i386.