Well, there's one right there in the firebird.conf, but perhaps it isn't obvious enough. Here are the basic settings ('None' to disallow UDFs completely and 'Full' to allow them anywhere) which you probably understood yourself:

UdfAccess = None

UdfAccess = Full

And here is that tricky Restrict setting:

UdfAccess = Restrict C:somedirectory

For multiple directories, use something like this:

UdfAccess = Restrict C:somedirectory;C:someotherdirectory

For Linux users:

UdfAccess = Restrict /some/directory

In the default setting 'Restrict UDF', 'UDF' is a directory relative to root directory of Firebird installation.