We need to wait for a better solution in Jessie+1

Personally, I'd much prefer root getting -EPERM than infinite looping in "ls". I suppose you could ask for a FUSE sysctl knob like fuse.footgun, but that's your fight ;) .

On the root-is-omnipotent front, have you heard of Secure Boot? I think it has benefits for groups like schools and companies who want to ensure that *their* hardware is used as intended, not by the student or employee. If I have root, it is not necessarily true that I own the hardware too (e.g., installing packages might be relevant for teachers). The fear with SB is that manufactures will start "owning" hardware they sell indefinitely. *That* is valid, but it is not a reason to not do it.