Maybe I did not provide the best example, but the point I was driving at is that the restrictions here are at the application level and not at the system level.

If you take the approach you are taking, similar to ForceCommand, you have to make sure none of the commands in your PATH allow code execution. For example git, vim, less, awk, and find, all of which I use on a daily basis, can all be used to re-launch a restriction free bash.

Once you remove all the commands you have to, how much of a shell do you have left?