1. 5
  1.  

  2. 1

    Ouch, escaping the sandbox via the /dev/mem descriptor sounds bad. We need cap_mmap_ranges_limit or something! :D