This sounds exactly like seccomp and seccomp-bpf in Linux, so I don't think the feature is special to OpenBSD. Chrome uses it, for example. From https://wiki.m

This sounds exactly like seccomp and seccomp-bpf in Linux, so I don't think the feature is special to OpenBSD. Chrome uses it, for example. From https://wiki.mozilla.org/Security/Sandbox/Seccomp#Intro_to_seccomp_and_seccomp-bpf https://wiki.mozilla.org/Security/Sandbox/Seccomp#Intro_to_s... "Seccomp stands for secure computing mode. It's a simple sandboxing tool in the Linux kernel, available since Linux version 2.6.12. When enabling seccomp, the process enters a "secure mode" where a very small number of system calls are available (exit(), read(), write(), sigreturn()). Writing code to work in this environment is difficult; for example, dynamic memory allocation (using brk() or mmap(), either directly or to implement malloc()) is not possible. Seccomp-BPF is a more recent extension to seccomp, which allows filtering system calls with BPF (Berkeley Packet Filter) programs. These filters can be used to allow or deny an arbitrary set of system calls, as well as filter on system call arguments (numeric values only; pointer arguments can't be dereferenced)"