driveRoots property
Absolute path prefixes a mount may target. Empty allows any path (the operator is trusted, as with exec). A non-empty list rejects mounts whose resolved path is not under one of these roots.
Implementation
final List<String> driveRoots;