Limiting system calls via control groups?

I guess it's been considered already, but something like iptables or the Linux socket filter make sense to me. Provide unprivileged userspace with a small handful of operations for testing syscall number, doing comparisons and jumps, and looking strings up in a set, then leave the rest to a userspace library (actually I guess underneath this is probably what OS X' sandbox looks like too). That way extending the interface later is only a matter of adding extra operations.

If the overhead for running the pseudocode on each syscall was too high, then perhaps a declarative approach would be possible, where the kernel could transform the supplied rules into lookup tables, or some hybrid combination of both.