dmz: use overlayfs to write-protect /proc/self/exe if possible#4448