Historic reasons (like chroot being older etc.). But I believe the appropriate solution would be either: - a prctrl like PR_SET_RESTRICED_CHROOT which will "d

Historic reasons (like chroot being older etc.). But I believe the appropriate solution would be either: - a prctrl like PR_SET_RESTRICED_CHROOT which will "degrade" CAP_SYS_CHROOT to require all the thinks listed (but still requires CAP_SYS_CHROOT). - a new capability like CAP_SYS_RESTRICTED_CHROOT (probably not an option). The current patch would weakening the security sandbox of any process dropping CAP_SYS_CHROOT which IMHO is unacceptable given that PR_SET_NO_NEW_PRIVS is known as being imperfect.