In one embodiment, a system receives an exec function invocation request from a second application to run a first application from an executable file. In response to receiving the exec function invocation request, the system determines a working directory associated with the second application. The system determines one or more extended attribute values associated with the working directory. The system determines, in view of the one or more extended attribute values, whether to allow or deny the first application to use the working directory to run the executable file of the first application.