Hacker News Reader

SELinux is basically this.

Is that the service that everyone turns off as the first step of setting up their new Linux box?

It's the LSM that billions of Android users use every day.

https://www.canyonroad.ai/ does some of this in a way tailored to agents.

personally I wish the OS would allow syscall filtering per user

I use seccomp filters on linux in my AI sandbox.

Yeah, I just wish seccomp worked per user. So you could define a policy of which users can do which syscalls, and then that follows them no matter which application they start.