I'm a big fan of OpenBSD's pledge and unveil syscalls; the best overview of them is from SerenityOS' implementation:
https://awesomekling.github.io/pledge-and-unveil-in-Serenity...
https://awesomekling.github.io/pledge-and-unveil-in-Serenity...
At a conference years ago, someone proposed the idea of using this as the _only_ security mechanism in really tiny embedded systems. The implementation was 100-200 bytes in total.