OpenBSD adds unveil(), a new syscall for restricting filesystem access. Like pledge(), it aims to maximise adoption through having a limited (but very comprehensible) API. https://lwn.net/Articles/767137/