Wouldn't some kind of "syscall proxy" or a wrapper possible? There is gVisor [1] which if I understand correctly re-implements Linux kernel in userspace for sec

Wouldn't some kind of "syscall proxy" or a wrapper possible? There is gVisor [1] which if I understand correctly re-implements Linux kernel in userspace for security, pretty interesting. Such layer would have to re-implement missing pieces in Mach kernel though so maybe it would not be as easy. [1] https://github.com/google/gvisor https://github.com/google/gvisor