Only verify MAX_ARG limit when running privileged.

[brown]

I've hit the MAX_ARG limit. There doesn't seem to be any reason for it when bwrap is unprivileged.

[rh-atomic-bot]

Can one of the admins verify this patch?
I understand the following commands:

• bot, add author to whitelist
• bot, test pull request
• bot, test pull request once

[charmander]

I don’t see why the reason for the hardening would only apply to privileged bwrap.

[L-as]

I don’t see why the reason for the hardening would only apply to privileged bwrap.

If bubblewrap has no special permissions compared to the process executing it, then it makes no sense since the process could just do what the unprivileged bubblewrap would do if it disregarded the limit.

[charmander]

What if the data bubblewrap is parsing is the problem (i.e. untrusted), not the program passing it through?