Please see my comment to your parent. Additional hint: you should also care about dropping/controlling your user's groups, see https://github.com/sarnowski/mitigation/blob/master/mitigati...