[polaris64]

seccomp is a robust way of restricting a process's syscalls so that it can only do what you allow it to.

syswall is more of an interactive tool (similar to systrace as mentioned in another comment). The goal is not to replace seccomp (it's certainly not meant to provide complete security), but rather to allow users to reason about what a process is actually doing. For example, allowing users to see if a new version does something different from the previous, perhaps meaning that malicious code was added unexpectedly.