Taking control over dnsmasq seems potentially very useful even if it is running sandboxed. They're not a complete solution.