NIST 800-53 rev 4 CM-7(2) states:
(2) LEAST FUNCTIONALITY | PREVENT PROGRAM EXECUTION The information system employs automated mechanisms to prevent program execution in accordance with [Selection (one or more): authorized software programs; unauthorized software programs; rules authorizing the terms and conditions of software program usage].
What automated mechanisms exist in Linux to prevent specific program(s) execution? I understand Linux DAC permissions can be used at a high level to restrict execution of all programs, but that is not whitelist/blacklist implementation. I'm also aware that a strict policy implementation of SELinux could be used to satisfy a white list by requiring policies to be definied for every application that is approved. Are there any other options that are less onerous than SELinux strict policy (which is a considerable effort to implement in a strict policy configuration)?