This project http://sysjail.bsd.lv/ http://sysjail.bsd.lv/ was dropped because of exactly the same problem with systrace on BSD systems, found in 2007. Details

This project http://sysjail.bsd.lv/ http://sysjail.bsd.lv/ was dropped because of exactly the same problem with systrace on BSD systems, found in 2007. Details: http://www.lightbluetouchpaper.org/2007/08/06/usenix-woot07-exploiting-concurrency-vulnerabilities-in-system-call-wrappers-and-the-evil-genius/ http://www.lightbluetouchpaper.org/2007/08/06/usenix-woot07-... (Exploiting Concurrency Vulnerabilities in System Call Wrappers) It's not really possible to write wrappers which can inspect system calls, allow them to be blocked or modified, AND be efficient. Therefore they're not useful for security purposes because of the inherent race conditions.