I think OpenBSD comes the closest to what you want with its two easy to use syscalls that provide syscall filtering and restricting access to paths: https://ma

I think OpenBSD comes the closest to what you want with its two easy to use syscalls that provide syscall filtering and restricting access to paths: https://man.openbsd.org/pledge.2 https://man.openbsd.org/pledge.2 https://man.openbsd.org/unveil.2 https://man.openbsd.org/unveil.2 A few random examples: https://github.com/tmux/tmux/blob/c8494dff7b6b9a996866edaf8c57c4e4b393acd0/tmux.c#L435-L436 https://github.com/tmux/tmux/blob/c8494dff7b6b9a996866edaf8c... https://github.com/openbsd/ports/blob/master/www/mozilla-firefox/files/unveil.gpu https://github.com/openbsd/ports/blob/master/www/mozilla-fir... https://github.com/openbsd/ports/blob/master/www/mozilla-firefox/files/pledge.main https://github.com/openbsd/ports/blob/master/www/mozilla-fir... To get the best isolation you need to patch the source — the application needs to go through initial setup and then drop privileges to the absolute possible minimum. But it's easy to make custom wrappers for third-party applications — the above profiles taken from the OpenBSD ports tree are the proof.