The thrust of this is certainly fine. I only skimmed the patch. One thing I noticed is at least one case (chown) that looks like it could be replaced with a syscalls.list entry now. Thanks, Roland