Oh also there are two seccomp denials for sched_setattr and setpriority, neither of which are likely to be granted to this snap since they are considered somewhat privileged and we currently lack the ability to do fine grained pid filtering for syscalls in seccomp to limit the pids that a snap can use syscalls with to only their own snap cgroup.