The PT_SUSPEND_SECCOMP ptrace flag, which suppresses all seccomp checks for a process on kernels with CONFIG_CHECKPOINT_RESTORE, is supposed to only be settable by a ptracer with global CAP_SYS_ADMIN and no seccomp restrictions, but this is only enforced on the PTRACE_SETOPTIONS path. The PTRACE_SEIZE path can set the same flag, but doesn't do the privilege checks.