anchor.diff:                   (list "setfacl" "-m" (format nil "u:~a:rwx" uid) home))
                  home)
                home))
  -     (directory (if (and home cd-home (not directory)) home directory))
  +     (inner-home (when home (or inner-home home)))
  +     (directory (if (and inner-home cd-home (not directory)) inner-home directory))
        (tmp (if (eq tmp t)
               (let* ((containing-directory
                        (format nil "/tmp/subuser-tmps-~a/"
  
positive.code:                  ,@(when grab-sound `(("-B" "/dev/snd")))
                   ,@(when (or mount-sys grab-dri) `(("-B" "/sys")))
                   ,@(when tmp `(("-B" ,tmp "/tmp")))
                   ,@(when home `(("-B" ,home)))
                   ,@ mounts))
                 ,@(when verbose-nsjail `("verbose"))
                 ,@(when keep-namespaces
  
negative.code: (defun subuser-nsjail-x-application
    (command
      &key display
      environment home inner-home tmp name locale locale-archive
      (slay t) (wait t) (netns t) verbose-netns
      network-ports network-ports-in
      netns-tuntap-devices
  