geteuid() without CAP_SYS_ADMIN is not enough to do unrestricted seccomp(). Hence tighten the check. See: #19746 (cherry picked from commit 6da5d7de)