I think (please correct if I am wrong), systrace has some race conditions and is not considered completely secure. "Applications that use clone()-like system c

I think (please correct if I am wrong), systrace has some race conditions and is not considered completely secure. "Applications that use clone()-like system calls to share the complete address space between processes may be able to replace system call arguments after they have been evaluated by systrace and escape policy enforcement." http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man1/systrace.1?query=systrace http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man1/... OpenBSD apps leverage traditional approaches heavily like chroot and privilege separation through different users - even within applications but there is no network separation or similar as in jails or Linux namespaces.