jail: make /proc more secure