Aren't systemd's security capabilities in userspace simpler to use?

Caps actually control access to facilities "above" what a normal user has, i.e. stuff that normally only root has. OpenBSD's tame() stuff otoh limits access to facilities that even normal users have, hence systemd's CapabilitiesBoundingSet= cannot cover what tame() covers.

That said, I am pretty sure the tame() API is frickin' crazy, and seccomp() actually a ton more useful, especially if you use it in conjunction with some namespacing tricks like they are exposed with systemd's PrivateTmp=, ProtectSystem= or PrivateNetwork=.

I find Theo's comment on seccomp controlling programs with other programs particularly weird, given the the seccomp filters are not turing complete, and hence hardly more than a fancy parameter check, and hardly something I would really call a "program".