That's an interesting idea, but note that the attacker need not call "exec",
that's just the easiest approach. Given access to "open", "write" and "chmod"
or "umask" is probably equivalent, it just takes longer to write the exploit.
And while I can see giving up a variety of system calls to enhance security,
"open" and "write" are not among them. (-:
Another alternative that has the advantage of already existing and being
relatively easy to use is the chroot() system call. For example, named would
be a much less attractive target it if chroot()ed to /etc/namedb (or whatever)
as soon as it knew where its startup directory was. Then all named could do is
mangle your name service files.
Never mind that named could setuid to non-root once it had its ports bound....