IIUC, you would usually have a separate subprocess responsible for file access only, communicating over IPC with a less trusted and more complex process (eg. on

IIUC, you would usually have a separate subprocess responsible for file access only, communicating over IPC with a less trusted and more complex process (eg. one that parses documents and renders fonts). See: architecture of acme-client(1): https://kristaps.bsd.lv/acme-client/ https://kristaps.bsd.lv/acme-client/