This can be done with capability-based operating system, though it requires running the libraries you want to isolate in a separate process. On a capability-ba

This can be done with capability-based operating system, though it requires running the libraries you want to isolate in a separate process. On a capability-based OS you whitelist the things a given process can do. For instance, you can give a process the capability to read a given directory and write to a different directory, or give the capability to send http traffic to a specific URL. If you don't explicitly give those capabilities, the process can't do anything.