I see this as one of the big unintended benefits of AppArmor and SELinux: it's easy to filter for the relevant subset of files.