More sophisticated sandboxing.
Add the bits that cmsenv/cmsRun actually need.