Or another cool idea use .preinit_array for shared bins and .init_array for static bins and inject a .seccomp, .unshare, etc section that gets called in the pre

Or another cool idea use .preinit_array for shared bins and .init_array for static bins and inject a .seccomp, .unshare, etc section that gets called in the preinit, init. This way you can support both shared and static bins with a tiny size increase.