That's what SElinux is for. However, you might have to write your own policies, the usual ones that most distributions ship are tailored to the server usecase.

That's what SElinux is for. However, you might have to write your own policies, the usual ones that most distributions ship are tailored to the server usecase. Android also uses SElinux for that kind of access restrictions, but works somewhat different form "normal" desktop linux.