[caf]

You don't even have to copy the filenames around and mess with changing page permissions - simply doing:

  static const char * const dev_null = "/dev/null";

and then whitelisting the pointer dev_null is sufficient, because string literals are stored in the text section which is mapped read-only.

[amluto]

That only works if you've locked down mprotect, mmap, and munmap.

[caf]

Yes, the parent covered that.