This is often repeated in these kinds of threads, but I don't think it's true. You just have to implement it in glibc, which can map the flags to the actual syscalls used on the current architecture and restrict the process to those with a seccomp BPF filter.
(Indeed, cosmo libc does exactly that, so it's definitely possible.)
(Indeed, cosmo libc does exactly that, so it's definitely possible.)