* don't let network services mmap (or even open!) random executables through mandatory access control (SELinux)