proper group and shell for tools user
make /opt/basejail/tools non-world readable