There is apparmor(used by Snappy) that already allows you to lock down an process. In Ubuntu wiki they mention that there is some sort of Firefox profile, no idea if it is any use for daily driver though :)
Here's an apparmor profile I made to lock down the Skype linux client: https://gist.github.com/AgentME/5640268 . It works as a whitelist listing out exactly what Skype can access. I've got another profile for Steam (and all games that Steam starts up) which just blacklists a few directories (and lets me know if Steam or any games ever tries to access those).