On Tue, 1 Dec 2020 at 18:11, Stefan Sperling <stsp@stsp.name> wrote:
>
> Couldn't you apply capsicum to open file descriptors provided via newly
> initialized struct got_worktree and struct got_repository, and enter the
> sandbox before the main operation logic of the got command starts executing?

Yes, this is likely the approach to take; once the root directories of
the repository and of the working tree have been located we can enter
the sandbox and no longer rely on ambient authority or access to
global namespaces.