Upon further reflection, instead of chmod o-x, use chmod 700. Otherwise, the fprintd-enroll executable can be copied to the home directory and executed from there, successfully changing the enrolled prints without requiring root.
Upon further reflection, instead of chmod o-x, use chmod 700. Otherwise, the fprintd-enroll executable can be copied to the home directory and executed from there, successfully changing the enrolled prints without requiring root.