limiting user execution rights

[hyper]

I know there is an option in the grsec patches which
makes users unable to execute programs from directory
other then owned by root. Is there any way without to
do this without modyfying the kernel? I tried researching
on restricted shells, but I don't think thats what I want.
Is there maybe an external ACL system?

hyper