We need to introduce a VirtualFilePermission which works like FilePermission but for VirtualFiles. The VFS filesystem providers then need to run in privileged blocks with initial security checks upon construction for the physical filesystem constructs they represent.