#sandboxing

Seccomp gains non-cooperative pin redirect to close TOCTOU

A kernel series lets sandbox supervisors feed immutable syscall arguments into uncooperative targets without a trusted setup window.