OS X sandbox

[beltex]

• As a reminder to factor this in (I/O Kit)
• It may be there's nothing we have to do. The burden is really on the client with having a privileged helper thats called through launchd
• This is default for iOS, so nothing extra needed