I believe one can use "capabilities" and seccomp to lock down a superuser process.