Not sure what your goals are specifically, but even apparmor and selinux can do things like block access to the network, limit read and/or write access to certain directories, limiting what system calls can be made, and notify you of failed attempts.

I didn't (at the time) know that PDFs could "phone home" to report details of the system reading a PDF. A selinux profile denied access to the internet, and it was many months (and 100s if not 1000s of PDFs read) before one attempted network access and denied it. Ubuntu and Redhat (and I'm sure others) have reasonable defaults, so much of the work is already done for you.