Disable sandbox for 'file' calls

     -S, --no-sandbox
             On systems where libseccomp (https://github.com/seccomp/libseccomp) is available, the -S flag disables sandboxing which is enabled by default.  This option is needed for
             file to execute external decompressing programs, i.e. when the -z flag is specified and the built-in decompressors are not available.  On systems where sandboxing is not
             available, this option has no effect.

atool

@@ -1540,7 +1540,7 @@ sub findformat($$) {
         warn "$::basename: ".quote($file).": format not known, identifying using file\n";
                         }
     }
-    my @cmd = ($::cfg_path_file, '-b', '-L', '-z', '--', $file);
+    my @cmd = ($::cfg_path_file, '-b', '-L', '-z', '-S', '--', $file);
     $spec = backticks(@cmd);
     if (!defined $spec) {
       warn "$::basename: $::errmsg\n";