Seccomp

Seccomp is a security system in the Linux kernel. It allows a process to make a one-way transition into a secure state where it cannot make certain system calls and can only interact with already-open file descriptors.