bug#45198: 28.0.50; Sandbox mode

[Philipp]

> Am 17.04.2021 um 17:57 schrieb Eli Zaretskii <eliz@gnu.org>:
> 
>> From: Philipp <p.stephani2@gmail.com>
>> Date: Sat, 17 Apr 2021 17:44:06 +0200
>> Cc: João Távora <joaotavora@gmail.com>,
>> 45198@debbugs.gnu.org, Stefan Kangas <stefankangas@gmail.com>,
>> Stefan Monnier <monnier@iro.umontreal.ca>, Alan Third <alan@idiocy.org>
>> 
>>> It works and can be pushed right away but it would be nice to have a place 
>>> to use it, for validation and for tuning the interface. Any plans for that?
>>> 
>> 
>> I think it would be better to first implement the mechanism and not the 
>> high-level `sandbox-enter' function (I think that one needs a bit more 
>> discussion), and implement the mechanism as a command-line flag.
> 
> IMO, if we have no reasonably clear idea how this will be used on the
> high level,

I have a relatively clear idea how I want the high-level interface to look like:

(cl-defun start-sandbox (function &key readable-directories stdout-buffer) ...)
(defun wait-for-sandbox (sandbox) ...)

where start-sandbox returns an opaque sandbox object running FUNCTION that 
wait-for-sandbox can wait for.  That should be generic enough that it's 
extensible and implementable on several platforms, and doesn't lock us into 
specific implementation choices.

If that's OK with everyone, then I'm happy to write the code for it.