Sandbox abstraction proposal

[mptre]

Related to GitHub issue #269 and #271.

[calleluks]

This is really cool! Thanks for the great work @DBOTW and @mptre. Should #274 be merged into the branch for this PR?

It's not clear to me why the build is failing or why it's not outputting "disallowed syscall" messages.

[mptre]

It's not clear to me why the build is failing or why it's not outputting "disallowed syscall" messages.

I've been trying to figure out why the disallowed message doesn't show
up on Travis. Even strace:ing pick shows that the write call succeeds. I
got a bit reluctant to shipping support for seccomp after reading
this. The plan was to make make check || cat test-suite.log output
the missing syscall to ease debugging on platforms experiencing
failures.

[ghost]

I got a bit reluctant to shipping support for seccomp

seccomp should be disabled by default but can be used with --enable-seccomp ...
(latest #274 has been modified accordingly)

[ghost]

Quoting google/sanitizers#777 (comment):

Our general suggestion is to disable any sandboxes in sanitizer builds.

... I'm doing so in latest #274 ...