All system files MUST be handled by portage. Other users and processes may write into their homedirs and limited access to /var/ and /tmp (for root user — also /etc and possibly /boot with /lib/modules). I use amd64 system (with =sys-apps/openrc-0.19.1). After some tests with =net-dns/dnscrypt-proxy-1.6.1 I was very unpleased finding in my system an empty orphan /syslog (!) file (see bug #588462). Probably such actions should be filtered by openrc interpreter (now /sbin/openrc-run). Possibly, direct invocation of base utilities (chmod/chown, mkdir and touch) also should be forbidden.
This seems a bit beyond the scope of OpenRC itself. However, someone suggested to me that you might want to consider using apparmor [1], which is also available in Gentoo. If you find that this doesn't do what you want, please feel free to re-open this bug and provide more information on what you are looking for. Thanks much. William [1] https://apparmor.net
