Wrap sh to propagate set options more consistently.
Fix creating encrypted chroots. Fixes #517