Used by profiles before to confine pre login script bfore transitionning to user hat. It should only be enabled when mapping is enabled as otherwise the shell is not confined.
