And often times sandboxing it is hard.

E.g.: what do you use to edit ~/.ssh/config or ~/.profile?