This seems like a great idea. As others have commented, to actually work, system call filtering has to be done from the kernel side, and this seems like a great way to do it.
We should have done this way earlier. Perhaps one day we can rip out the LSM hooks and replace them with attachment points for BPF code. That would remove a lot of ugly policy from the kernel, but provide the needed mechanisms.