soapbox -- A library to restrict processes from tampering with directories/files.
http://dag.wieers.com/home-made/soapbox/
Soapbox allows to restrict specific processes to write only to those places you want files to be changed. Read-access however is still based on file-permissions. By preloading the Soapbox library, you can run programs as root and still be safe that they don't mess up your system.