In my experience, most sandboxing systems seem to be deficient in many ways. (It would be possible to improve it (I don't know what changes might be required in the kernel, although some things might be possible with ptrace, it would make it difficult and possibly inefficient and/or unportable), although making an entirely new computer design would improve the security more than that.)