removed vc_chrootsafe(); such an implementation seems to be impossible...