Alternatively you can just give it its own user. I do that, so it can blow up its own files, but not mine.