Location of binaries

[jdehaan]

Using the command without full path is risky. There should be a way to pin the binaries allowed by exact path in a safe way. Could all this be solved via a apparmor config instead?