It looks like you could lock down the environment variables with rbash <a href="http:&#x2F;&#x2F;unix.stackexchange.com&#x2F;questions&#x2F;66627&#x2F;is-there-anyway-to-set-a-readonly-environment-variable" rel="nofollow">http:&#x2F;&#x2F;unix.stackexchange.com&#x2F;questions&#x2F;66627&#x2F;is-there-anywa...</a><p>But that&#x27;s getting into no-man&#x27;s land I guess