- Added -B src:dest (like -b) but this makes bind mounts in
read-only mode.
- Get rid of setfsuid(), it's unnecessary.
- Make sure chrootdir is not '/', use realpath().
- Always set SECBIT_NOROOT, see capabilities(7).
- Do not mount recursively, right now this only mounts
/dev (ro), /dev/shm (rw), /sys (ro) and /proc (ro).
Previously any mount below any specific mount were recursively
mounted in chrootdir.
b9fb5e1cc8