Distributors ponder a systemd change

I'm not entirely clear on how SELinux would help here. You can't change the context of a process without its cooperation, and you still don't have any kind of revoke(). How would you restrict the ability of processes to continue to use resources they had access to before the user logged out?