There are also controls that specify noexec, nodev etc for filesystems.