kernels provided this feature since forever. selinux, trustedbsd, you name it, provided this.
seccomp on linux is just a "in code, per process" version, while selinux, or earlier things like RSBAC or LIDS provide more flexibility (but apparently, nobody understood how to use any of this in the past :)
Re:Asm.js in Firefox Nightly
by pifflesnort on Friday March 22, 2013 @11:16AM
(#5423433)
The major difference is that I can run a NaCL process(es) inside my own userspace process without kernel support, and that a failure in my sandboxing won't also be a failure inside the kernel.
A bit off topic, but this already exists, in the sense that there is no difference between NaCl-style sandboxing and what every OS kernel already provides for its processes, except that NaCl is generally locked down tighter. All that would need to happen is for OSes to provide support for containers with arbitrarily restricted syscalls (as Linux already does) and NaCl could give up on the software fault isolation without any real loss in security.