file: strengthen exec access control