I just figured out that the tilde applies to the entire list, not just the first entry. So if I get this right, that filter is a list of *disallowed* system calls.
I've tested simply removing @mount from that list, and that is enough to make it work in chroot mode.
