That seems like a massive hole in the model that would make it very hard to lock down multi-process/privsep programs like sshd.
replySandboxing something like that is challenging, yes. But probably not for this reason you can always disclaim responsibility for your process.
replyIt really isn't; the program just needs to be able to declare what it expects it should be able to do, and what it expects its children should be able to do. The latter doesn't need to be a subset of the former.
replyThis is really hard to do in general
replyIndeed. It’s very inconvenient to ‘cd` and have to do the whole permission dance to read a file
reply