For extra points you could guarantee the structure of data by only allowing certain tools (selinux context maybe) that are trusted to write the files with the r

For extra points you could guarantee the structure of data by only allowing certain tools (selinux context maybe) that are trusted to write the files with the required structure. That would save a lot of repeated wasteful parsing and checking.