[mperham]

OpenBSD has had “pledge” for quite a while. I think it’s a good idea, I wish it was supported by Linux because, as you note, a few basic patterns could help immensely.

https://man.openbsd.org/pledge.2

[yencabulator]

Linux ended up with seccomp and landlock.

https://docs.kernel.org/userspace-api/seccomp_filter.html

https://docs.kernel.org/userspace-api/landlock.html