Seccomp: replacing security modules?

You can implement a pure capability model from userspace. The way to do it is to have some daemons that do the privileged operations on behalf of other processes. This is more or less the route Android went down.

Ingo's idea is probably a better way to implement LSM than the current implementation. The problem is, we don't really need LSM in the first place. All of the stuff that the NSA wanted to do with security levels and so forth could have been done in a much cleaner way from userspace.

The point of a sandboxing API is not to construct elaborate policies. It's a tool that makes it easier to implement secure systems in general. Then if people want elaborate policies, they can build that on top.