Detect security violations (network access, probably other destructive actions)

It is possible to detect certain malicious actions that may be performed by a submission. E.g. network access can be detected by setting up a fake network device (tun) and treat any packed being transmitted as a security exception; attempts to overwrite system files could be detected by implementing a fuse-based BigBrotherFS and trapping on write requests; etc.