Grsecurity on your host kernel (nothing to have with UML) can deny disk mounting/unmounting from your chroot jail, some TCP/IP staff restrictions and more.
Grsecurity is easy to build in gentoo's kernel to only protect a jail. Not comparable to try to build a workstation with PAX or SElinux...
