Sounds like the “file sealing” API combined with memfd handles that: https://lwn.net/Articles/593918/