Policy for a user that can't write any files (apart from in /tmp).

Is it possible now-a-days with MAC, etc, to set a per user policy such
that the user doesn't have permissions to write to the file system?
I've got a remote user that's logging in to make backup, and it would be
really cool to prevent them from modifying anything with out futzing
with file permissions and groups.

Joe
-- 
Josef Karthauser (joe_at_tao.org.uk)	       http://www.josef-k.net/
FreeBSD (cvs meister, admin and hacker)     http://www.uk.FreeBSD.org/
Physics Particle Theory (student)   http://www.pact.cpes.sussex.ac.uk/
================ An eclectic mix of fact and theory. =================