pkey could be useful to implement in-proc sandboxes.
ref: https://man7.org/linux/man-pages/man7/pkeys.7.html
int pkey_mprotect(size_t size;
void addr[size], size_t size, int prot, int pkey);
int pkey_alloc(unsigned int flags, unsigned int access_rights);
int pkey_free(int pkey);