I think OpenBSD's `pledge` syscall would be sufficient in this case. Calling

    pledge("stdio rpath wpath", {"path/to/input", "path/to/output"});

would blacklist any subsequent syscall that are not in the stdio or rpath or wpath lists [0] or pertain to a file that is not the input or output.

[0] http://man.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man2/...

Even if it's in a box, you need to pull the thing you want back out of the box. A malicious file could put a payload into the destination file.

Yes, by containing the payload and decompressing it.

The difference is that by not sandboxing it, that malicious file could also cause its payload to be executed in the permission scope of the decompressor.

That's pointless. Putting the malicious file in the archive would accomplish the same result.

We're at the point where tools can automatically transform code for safety with OK penalties and some MAC implementations have about no penalties. Yet, still no use on the exact types of tools they're easiest to apply to. (Shakes head.)

Same with transcoders