I think OpenBSD&#x27;s `pledge` syscall would be sufficient in this case. Calling<p><pre><code>    pledge(&quot;stdio rpath wpath&quot;, {&quot;path&#x2F;to&#x2F;input&quot;, &quot;path&#x2F;to&#x2F;output&quot;});
</code></pre>
would blacklist any subsequent syscall that are not in the stdio or rpath or wpath lists [0] or pertain to a file that is not the input or output.<p>[0] <a href="http:&#x2F;&#x2F;man.openbsd.org&#x2F;cgi-bin&#x2F;man.cgi&#x2F;OpenBSD-current&#x2F;man2&#x2F;pledge.2" rel="nofollow">http:&#x2F;&#x2F;man.openbsd.org&#x2F;cgi-bin&#x2F;man.cgi&#x2F;OpenBSD-current&#x2F;man2&#x2F;...</a>