Whoops, seems that you're right, I was wrong about interpreters taking noexec into account - either I misremembered something or things changed, but the fact is

Whoops, seems that you're right, I was wrong about interpreters taking noexec into account - either I misremembered something or things changed, but the fact is they don't. Sorry. Anyway, it's also better to have noexec than not. :) At least, it'll help if there's no complete shell access but only ability to run some binary by name, without args, or modify environment variables when running some executable.