Shameless plug, inspired by pledge(2), if you're a Linux rather than BSD person: how to use elementary virus writing techniques to sandbox programs under Linux using seccomp-bpf: https://tia.mat.br/posts/2016/11/08/infect_to_protect.html