Yup, this is the better approach to sandboxing. You can always expand a whitelist, but it’s not so easy to play black-a-mole.