Filesystem

Directly accessing the filesystem triggers a security elevation. However, we can include a filesystem interface that can be accessed without the security elevation.

The interface version is useful. First - it means that a library cannot secretly access the filesystem, it has to request access. Second, we can create a virtual filesystem to sandbox an application. The sandbox can even be persistened. We can also add alerts so that if a library tries to do something suspicious (like accessing os files), we can track it.

We can also create an intermediary that does allow direct access to the filesystem but limits what files and directories are shown.