So sadly, I screwed up the invocation of `prctl(PR_SET_NO_NEW_PRIVS` -
we need to provide 0 for the remaining arguments, otherwise the
kernel will *always* give us `-EINVAL`.

I didn't notice this at the time because I wanted to support the RHEL6
kernel.  Anyways, I no longer care about RHEL6 myself, and I'm going
to declare no one else should either =)