Use a basic seccomp-bpf filter

[madaidan]

seccomp-bpf allows you to filter which syscalls an application is allowed to use.

Firejail and bubblewrap (#62) both have seccomp support. Firejail also has a seccomp guide.

Orjail shouldn't use a very restrictive filter as that'd break many applications running inside it but it can use a simple blacklist that blocks certain dangerous syscalls.

Firejail has a default seccomp blacklist that can be enabled via the --seccomp flag. See the --seccomp part at the man page.