title: Is it possible to restrict what commands php can pass through exec at an OS level?
body: <p>I am currently hosting a <a href="http://drupal.org/">Drupal</a> 6 site on a CentOS machine. The Drupal (<a href="http://en.wikipedia.org/wiki/Content_management_system">CMS</a>) configuration contains a few dozen third-party modules that should not be <a href="http://en.wikipedia.org/wiki/Fork_%28software_development%29">forked</a> as a general best coding practice. However, some of these modules make use of the <a href="http://php.net/manual/en/function.exec.php">php <code>exec</code></a> command in order to function properly.</p>
  
  <p>The site allows for admins to embed php code snippets in any page via a UI configuration, granted that they have access to the php code input format. I need to keep this input format available to admins because there are several nodes (pages) and panel panes that make use of small, harmless php code snippets, like embedding a specific form into the content region, for example.</p>
  
  <p>The issue is that if someone were to compromise an admin account, then they could run arbitrary php code on the site, and thus run shell commands via php's <code>exec</code>, <a href="http://php.net/manual/en/function.passthru.php"><code>passthru</code></a>, etc. Is there any way, from an operating system level, to restrict what shell commands php can pass through to the machine? Could this be done via restricting file permissions to some programs from php?</p>
  
  <p><strong>Note:</strong> I cannot use the php.ini <a href="http://www.php.net/manual/en/ini.core.php#ini.disable-functions">disable_functions</a> directive as I still need <code>exec</code> to function normally for many cases, where modules make use of certain shell commands, like video encoding, for example.</p>