(a) Is there? and if so (b) what is a standard or accepted way for MAC systems to deal with complex software and in particular with Python, Bash and other interpreters? (in terms of creating rules for this kind of "complex" and "versatile" software)
With python for example, it appears to me to be impractical to regulate the access the python process receives on the basis of the executables (which will always be the python executables etc). It at best would rather be regulated according to the trustworthyness of the "python-script" code involved (as this also defined the resources needed).
Referring to MAC (mandatory access controll) here is meant to give reference to certain software like SELinux, grsecurity, TOMOYO, Apparmor and alike. (I am still struggling with the right term to reference to those concepts and software, which is why I express it here, trying to avoid ambiguity.)
The MAC is conceived here to be a tool/way to enhance security that goes in some way beyond things possible with discretionary access control (DAC).
This "additional security value" is caused by controlling the access in a more detailed manner than it might be possible with the DAC. As an example the access which a software receives may be based on more than just the USER its process is started with. And of course the files and resources that can be touched by a certain process is at best fine-tailored to the bare limit the programm actually needs.
It can be seen as a key goal of a MAC to limit the access to the minimum necessary.
If limiting (for security concerns) the access of a programm to those resources that it actually only needs is something which is wanted from a MAC system, than this seems most easy/practical for software which has a very limited functionality. Likewise more versatile and complex software seems by very far be much harder to be confined and limited.