Comment by starside

You could probably use SELinux to do something similar