-------- Original Message --------

>     Thanks for the link. The tool is to run securely an untrusted, buggy, or
> exploitable binary. I'm not sure this is something I need.

I'm not sure how you got that impression

My concern is rather
> to secure the programs I write, and to make security obvious to people who
> possibly review the source.
>

That is how Pledge is designed but it does need kernel or libc support on Linux
by the looks of it.

https://github.com/jart/pledge

>     By reading a little more, it seems to me that Pledge isn't really fine-grained.

Looks like it's using seccomp and landlock to provide the same API of OpenBSDs
pledge that is designed to be easy for a Unix user to work with (Unix syscall
knowledge etc.).