You would proabobly want to remove some tools like nmap and ettercap to be sure that you're not giving them utilitys to hack around or outside your network.

I was wondering - can it be done so that /home couldn't run binarys.