1 of 3

Restrict system calls to only a subset for specific groups/users/executables

Mobile operating systems like Android or iOS define sets of permissions (e.g. read contacts/send sms/access camera, ...) a user needs to specifically grant to an application in order for the latter to perform certain actions.

Are there similar concepts available for Linux on a Kernel-Level? For example I might want to restrict a program to a subset of the available system calls by setting certain flags/specify some meta-file/define more fine grained rules for specific users or groups than read/write/execute, ... in order to improve security.

If I could prevent a program from doing I/O or access the network, that I am sure does not need those resources I might potentially be a lot safer in certain scenarios...