Capsicum did this for the POSIX model, and they have rigorous analyses (and maybe proofs). But of course the first thing they did was remove the filesystem namespaces from the process, requiring significant rearchitectures of existing software. You can still use file descriptor passing to give file and even directory access, but it still requires some significant work.

Linux never accepted the Capsicum patches, but they eventually added process descriptors and some important openat flags so that almost all the difficult pieces are effectively in place.

I don't know how far along they've gotten (presumably not as nearly far as OpenBSD has gotten with pledge+unveil refactorings), but FreeBSD reworked many of their utilities and services to utilize Capsicum.

Capsicum was an amazing project. I am not familiar with where it is at the moment and not freeBSD user (though looks more and more tempting) and I thought a lot of it went largely unused, if you have any links on how they built stuff around it I would be very interested.

> OpenBSD pledge+unveil This was one of those things that now seem obvious, and is elegant albeit in that unixy way. From what I can tell one could built something on linux with seccomp or openbsds pledge to implement a runtime that could allow for implementing such structures all in usersapce not just process isolation but creating IPC that allows for determinism and other things. (I think it's more seccomp with filtering syscalls though where this becomes feasible I don't know if anyone has done this before)