Restricting write access to file systems

[Callihan, Michael S]

I would like to give cp, mv, mkdir, touch .... types of file access to some
users in certain directories such as /dummyfs however,  they will have no
need to change anything in /etc, /var, /sbin .....  
I also ran across the possibility of setting links to files in /etc, /var,
/kernel, ... which makes this even more difficult.

Besides writing a complex wrapper(s) to parse every argument, is there a
simple way to do this?  

Thanks for any insight.
Mike