Proof-of-concept, default-permit seccomp-bpf sandbox

Can be disabled by adding -DCONFIG_NOSANDBOX to CXXFLAGS.

src/sandbox/Sandbox.hpp

@@ -0,0 +1,21 @@
+#pragma once
+
+// use the sandbox on supported platforms, unless disabled
+#if defined(__linux__) || defined(__OpenBSD__)
+
+# if !defined(CONFIG_NOSANDBOX)
+void sandbox_start();
+# else
+
+#include <iostream>
+
+inline void sandbox_start() {
+    std::cout << "[WARN] Built without a sandbox" << std::endl;
+}
+
+# endif // CONFIG_NOSANDBOX
+
+#else
+// stub for unsupported platforms
+inline void sandbox_start() {}
+#endif