Between capabilities, namespaces, control groups, mandatory access control (AppArmor etc) and other mechanisms, I think there are plenty of ways to reduce user access to any part of the system.