>* You can completely isolate it from anything else. Lock it into a sandbox. Use >SELinux to ensure it doesn't do anything weird.

But the whole point of the plugins is to do weird things. Otherwise it could just use the defaults.