A fork of the Debian Almquist Shell (dash) that applies a kernel-enforced confinement policy to itself before it executes anything: Landlock on Linux, unveil and pledge on OpenBSD. The backend is selected at build time; section 7 of doc/design.md covers the OpenBSD side.