Split out sandboxing options used for the chroot