""The discussions brought up an old Bug report of [mine] about
writing policy for the 'little things'. SELinux does a great job of
confining System Services, but what about applications executed by
users. The bug report talked about confining grep, awk, ls ... The
idea was couldn't we stop the grep or the mv command from suddenly
opening up a network connection and copying off my /etc/shadow file
to parts unknown." Paris also posted an introduction to the sandbox
on linux-kernel."
