On Linux, [SysProcAttr] now supports enforcement of Landlock policies and the PR_SET_NO_NEW_PRIVS flag for newly spawned subprocesses.