It really should not be too hard to put the whole thing into a sandbox where only select files can be accessed. But desktop OSs are way behind here.