STRICT_DEVMEM and IO_STRICT_DEVMEM, SECCOMP and SECCOMP_FILTER
are not self protection features. They cut attack surface.

I'm also not sure about SYN_COOKIES. Mark it with a comment.