Firejail attempts to mitigate that with secomp filters.