Interesting no mentioned about OpenBSD pledge(2), unveil(2). By far the easiest sandboxing out there. An example:

    #ifdef OpenBSD
      if(pledge("stdio rpath wpath cpath",NULL) == -1)
        err(1,"pledge\n");
    #endif