Security implications of `--cap-add=SYS_PTRACE --security-opt seccomp=unconfined`? (needed for rr)

See also: https://github.com/JanitorTechnology/janitor/pull/315

TL;DR: This doesn’t really answer the question, but maybe we don’t need to use seccomp=unconfined to enable rr support after all. Enabling just the syscalls ptrace and perf_event_open should be enough (in combination with adding CAP_SYS_PTRACE).

As you can see in the list of blocked syscalls, the security implications of enabling just ptrace and perf_event_open seem to be “only” leaking host information, whereas enabling all syscalls with an unconfined seccomp sounds a lot more dangerous.