how to sandbox a c++ child process on MacOSX?

So here is what I want to do:

I have a parent process that is trusted. I want this parent process to run a child process, which is untrusted.

The child can be an arbitrarily sourced script, or just written pooly. I want it run safely, without worrying (too much) about the child "doing bad things".

The child will communicate to it's parent via message-passing, probably via shared-memory.

These child will be a script, in a language that I have made, and run in a VM. However, this VM has access to low-level unix functions, like exec/kill/open/read/write/remove/etc. This is fine for trusted scripts.

But for untrusted scripts, it is not acceptable.

Instead, I want to block access to almost all syscalls. I've seen proposals like disable(): https://www.reddit.com/r/osdev/comments/1mpphmo/adding\_a\_disable\_syscall/ But of course... this does not exist yet.

OpenBSD has a "pledge()" call. But I need this on OSX.

I've heard of `ptrace()`being used to acheive this. I don't know how to do this. Does this work well on MacOSX?

Obviously... the idea is to acheive this workflow:

1. Parent sets up shared-memory for communication
2. Parent calls fork
3. Forked child drops most of the permissions or abilities
4. Forked child calls exec()
5. Exec'd child then has to drop the permission to call exec!
6. Exec'd child finally does the required work

Something like that. That or something simpler that acheives the same goal.

I don't need this immediately, but sometime before 3 months I will want this. But I can start today if I get good info today.

https://redd.it/1p249qy
@r_cpp