For some user 'bob' in Linux is it possible to restrict the stuff executable by 'bob' to specific paths only.
As an example suppose that the 'bob' has the home directory /home/bob
'bob' must not be able to read/write/execute (zero rights) anything above /home/bob ever.
/bin, /lib, /usr/bin, /usr/lib, /usr/local/bin, /usr/local/lib, etc. are explicitly given appropriate settings rx - so 'bob' can execute stuff from these paths but not write to them.
'bob' has rwx rights to own directory (/home/bob) but is it possible to disallow bob to execute stuff from his own directory by default and then allowing some stuff (launchers, scripts, etc selectively) to be executable by 'bob'
please note - 'bob' can compile own stuff in /home/bob and run that stuff (this should be prevented). Also 'bob' can always use chmod, chgrp, etc. on files owned by himself. What is needed is execution prevention - even on owned files.