geteuid() without CAP_SYS_ADMIN is not enough to do unrestricted seccomp(). Hence tighten the check. See: #19746
mentioned in commit cdb99ab6