It has its own memory namespace, so it won't be allowed to access the kernel memory. It has however full access to the devices.

The /dev/lua device, which allows interaction with the kernel interpreter: https://man.netbsd.org/lua.4

Presentation: https://www.netbsd.org/gallery/presentations/mbalmer/fosdem2...