High-level comments rather than a detailed code review:

(1) Capsicum changes should be well received by the OpenBSM community, as it's largely made up of FreeBSD folk, although Apple folk (etc) are also interested. Do make sure you update the configure framework to be aware of Capsicum, however, likely testing for the feature by looking for capsicum.h.

(2) I think sandboxing around the BSM parsing code is a really good idea -- parsing is always a risky business, and there's no need for the general execution environment to place trust in audit trails that may come from compromised hosts.

(3) It would be nice to be able to sandbox around processing of multiple file arguments. This might cause a change in the event model to introduce additional processes if we want per-input sandboxes. Otherwise, it's probably OK to open a vector of file descriptors up front and process them one by one, placing a lower limit on the number of arguments that can be processes. ARG_MAX is already a pretty arbitrary limit.