--- a/seccomp.json
+++ b/seccomp.json
@@ -123,8 +123,6 @@
 				"clock_gettime64",
 				"clock_nanosleep",
 				"clock_nanosleep_time64",
-				"clone",
-				"clone3",
 				"close",
 				"close_range",
 				"connect",
@@ -168,11 +166,7 @@
 				"flock",
 				"fork",
 				"fremovexattr",
-				"fsconfig",
 				"fsetxattr",
-				"fsmount",
-				"fsopen",
-				"fspick",
 				"fstat",
 				"fstat64",
 				"fstatat64",
@@ -234,7 +228,6 @@
 				"ioprio_get",
 				"ioprio_set",
 				"ipc",
-				"keyctl",
 				"kill",
 				"landlock_add_rule",
 				"landlock_create_ruleset",
@@ -267,9 +260,6 @@
 				"mlockall",
 				"mmap",
 				"mmap2",
-				"mount",
-				"mount_setattr",
-				"move_mount",
 				"mprotect",
 				"mq_getsetattr",
 				"mq_notify",
@@ -292,7 +282,6 @@
 				"nanosleep",
 				"newfstatat",
 				"open",
-				"open_tree",
 				"openat",
 				"openat2",
 				"pause",
@@ -301,7 +290,6 @@
 				"pidfd_send_signal",
 				"pipe",
 				"pipe2",
-				"pivot_root",
 				"pkey_alloc",
 				"pkey_free",
 				"pkey_mprotect",
@@ -389,7 +377,6 @@
 				"setgroups",
 				"setgroups32",
 				"setitimer",
-				"setns",
 				"setpgid",
 				"setpriority",
 				"setregid",
@@ -412,7 +399,6 @@
 				"shmget",
 				"shutdown",
 				"sigaltstack",
-				"signal",
 				"signalfd",
 				"signalfd4",
 				"sigprocmask",
@@ -453,12 +439,9 @@
 				"truncate64",
 				"ugetrlimit",
 				"umask",
-				"umount",
-				"umount2",
 				"uname",
 				"unlink",
 				"unlinkat",
-				"unshare",
 				"utime",
 				"utimensat",
 				"utimensat_time64",
@@ -709,6 +692,28 @@
 			},
 			"excludes": {}
 		},
+		{
+			"names": [
+				"clone"
+			],
+			"action": "SCMP_ACT_ALLOW",
+			"args": [
+				{
+					"index": 0,
+					"value": 2114060288,
+					"op": "SCMP_CMP_MASKED_EQ"
+				}
+			],
+			"excludes": {
+				"caps": [
+					"CAP_SYS_ADMIN"
+				],
+				"arches": [
+					"s390",
+					"s390x"
+				]
+			}
+		},
 		{
 			"names": [
 				"fanotify_init",