replaced use-seccomp by isolate-workers

That, if enabled, includes the Linux namespaces restrictions into workers.

src/main.c

@@ -882,6 +882,8 @@ static int check_tcp_wrapper(int fd)
 # define check_tcp_wrapper(x) 0
 #endif
 
+typedef pid_t (*fork_func)(void);
+
 int main(int argc, char** argv)
 {
 	int fd, pid, e;
@@ -903,6 +905,7 @@ int main(int argc, char** argv)
 	sigset_t emptyset, blockset;
 	/* tls credentials */
 	struct tls_st creds;
+	fork_func our_fork = fork;
 
 #ifdef DEBUG_LEAKS
 	talloc_enable_leak_report_full();
@@ -1000,6 +1003,10 @@ int main(int argc, char** argv)
 		}
 	}
 
+	/* override the default fork function */
+	if (s->config->isolate)
+		our_fork = safe_fork;
+
 	write_pid_file();
 
 	run_sec_mod(s);
@@ -1122,7 +1129,7 @@ int main(int argc, char** argv)
 					break;
 				}
 
-				pid = safe_fork();
+				pid = our_fork();
 				if (pid == 0) {	/* child */
 					/* close any open descriptors, and erase
 					 * sensitive data before running the worker