> a system-wide content blocking API (which Linux does not

Technically, isn't that what apparmor does?