I'm thinking that good standard practices and abstractions for SELinux and, optionally, per-application users would go a long way to solve these problems.