app/seal: skip /mnt in permissive default

This directory usually contains temporarily mounted stuff and shouldn't get into the sandbox.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>

internal/app/seal.go

@@ -134,6 +134,7 @@ func (a *app) Seal(config *Config) error {
 				case "proc":
 				case "dev":
 				case "run":
+				case "mnt":
 				default:
 					p := "/" + name
 					b = append(b, &FilesystemConfig{Src: p, Write: true, Must: true})