Seccomp profiles are typically applied externally to a process in my experience though. I think this is more analogous to using capset() to remove capabilities

Seccomp profiles are typically applied externally to a process in my experience though. I think this is more analogous to using capset() to remove capabilities in highly permissioned processes. For instance dnsmasq makes use of this ability to be minimally permissioned.