vim, grep, sed, and awk would need to inherit permissions from the shell for this kind of sandboxing to be reasonable there, maybe on account of being child pro

vim, grep, sed, and awk would need to inherit permissions from the shell for this kind of sandboxing to be reasonable there, maybe on account of being child processes. I wouldn't want to sacrifice any usability there, I do everything in CLIs.