chiark / gitweb /
nspawn: block open_by_handle_at() and others via seccomp