Unveil(2) – Unveil parts of a restricted filesystem view
This design is so thoughtful. Thanks to fork, you can easily sandbox a child process to a specific subtree of the filesystem: fork, unveil(0, 0), run untrusted user code.<p>I wish OS X and windows had this.