> but only a few trusted library files would be allowed to make system calls. Like libc

This is impossible (without having to do libc.so.7) on Linux, as:

    $ nm -D /lib/x86_64-linux-gnu/libc.so.6 | grep syscall
    000000000011b520 T syscall

https://elixir.bootlin.com/glibc/glibc-2.39/source/sysdeps/u...