Build scripts has too much capabilities than it would actually need. As a security measure, it may be good to perform some kind of sandboxing for them.

Things we could be restricting:

• Act as the nobody user, disallowing read of private files, or deletion of important files.
• Disable networking (with some way to opt out).

Strategy we could take:

• Just use some existing mechanism (changing user) to downgrade privileges. Is this possible?
• LD_PRELOAD and hook libc, which is what Gentoo use. Possible to bypass. Availability on Windows: possible, but probably harder than Linux.
• Full sandboxing with gVisor. Safe, but doesn't work for Windows indeed.