FreeBSD does this with Capsicum: https://wiki.freebsd.org/Capsicum