secure mount points: nodev, nesuid,ro,noexec. Noexec is of little use, because it can be easily bypassed by using /lib/ld-linux.so to execute binaries

chroot will not run on such system, because /dev/null and /dev/log