You can turn off access to all '#' devices except #{|decp}.  Look
at RFNOMNT on rfork.  I believe 'rfork m' in rc does an rfork(RFNOMNT).