Good idea. We could use a way to restrict visibility of the entine filesystem and only unveil the parts of it that every program declares/needs.