seccomp is a really exciting feature that I haven't seen talked about too often.
It actually played a fairly large role in CTFs this year, being used by LegitBS in the DEFCON Finals. Since we didn't have access to a lot of the syscalls we'd need to achieve persistence, we (and a lot of other teams), had to focus on actually solving the problems, instead of on sidestepping them with cheap tactics.
For postgresql it seems hard to do do so in a generic fashion. There's a great emphasis on being able to extend postgres and that extension code will do stuff we don't allow. Only superusers are allowed to configure/load such extensions for obvious reasons.
There are so called 'trusted' languages which means they execute code in a sandboxed manner. But they're mostly executed in the same process context as the normal backend, so it'll hard to effectively use seccomp afaics.
It actually played a fairly large role in CTFs this year, being used by LegitBS in the DEFCON Finals. Since we didn't have access to a lot of the syscalls we'd need to achieve persistence, we (and a lot of other teams), had to focus on actually solving the problems, instead of on sidestepping them with cheap tactics.