pledge

https://github.com/jeremyevans/ruby-pledge

pledge exposes OpenBSD's pledge(2) and unveil(2) system calls to Ruby, allowing a program to restrict the types of operations the program can do, and the file system access the program has, after the point of call. Unlike other similar systems, pledge and unveil are specifically designed for programs that need to use a wide variety of operations on initialization, but a fewer number after initialization (when user input will be accepted).