It looks like you could lock down the environment variables with rbash http://unix.stackexchange.com/questions/66627/is-there-anyway-to-set-a-readonly-environme

It looks like you could lock down the environment variables with rbash http://unix.stackexchange.com/questions/66627/is-there-anyway-to-set-a-readonly-environment-variable http://unix.stackexchange.com/questions/66627/is-there-anywa... But that's getting into no-man's land I guess