I have a Linux machine that contains sensitive files. Users should be able to access (read) them when they are using the computer, but should not be able to copy them to another hard drive (USB stick or another hard drive that might have been added on the same machine).
The main hard drive has been encrypted, in order to prevent someone from extracting it and stealing the files.
I am free to use SELinux or other approaches in order to achieve the goal.
After reading the answers, I would like to clarify:
I am not very concerned about users who may take a picture of the screen. Protecting the actual file is my main goal.
Even though protecting each and every file would have been optimal, I am mostly concerned about protecting the dataset as a whole (it is very large). Even if a few files get leaked, the damage is manageable. Moreover, due to the large amount of files, extracting them one-by-one in an inefficient way would not be practical.
The users of the computer will not be given administrative privileges.