Fix readlink() (in both launcher and child); Make sandbox read-only by default