Masks go into the chroot itself