Demo ptrace-based sandbox
Implement proxying; disallow sys_write where fd != 1, 2
IO sandboxing
Modularize ptrace sandbox
Add all syscall numbers
Kill open based on mode