Consider
firejail (compare: chown -R exclude some directory). This will also allow you to keep the list of hazards in one place as a profile.