This is why we need application sandboxes at kernel level. Selinux for example.