Discretionary access control let’s you specify read write and execute permission flags for three different classes of user: the user that owns the file, members of the group that owns the file, and other users. These three classes are often abbreviated with u g and o for user, group, and other. The permissions are abbreviated with r w and x for read write and execute. By calling chmod with o-x you are “subtracting” the x permissions for o users.

The file may still be executable by the files owner or users in the group that owns the file. To check, run ls -l and look at the part that shows rwxrwxrwx (any of which may be replaced with a -). This shows the permission flags in order for the owner, the group, and other users. If the flag is set you will see the letter abbreviation, if it is not set you will see -, so you would want the file to have permissions like r-xr–r-- and be owned by root, so only root can execute the file.

You can change the owner with chown root /path/to/file

If you want to get more crazy with permissions look up Linux ACLs or the setfacl and getfacl commands