Restrict the execution of external binary programs through whitelist of allowed files
<p>On a web server running PHP, I need the PHP scripts to be able to run one specific external program through <code>exec()</code>, <code>system()</code> or similar.
For that reason, the execution function must be enabled at PHP level.</p>

<p>However, to mitigate the impact of malicious PHP code I would like to limit the execution from PHP to the program needed only.</p>

<p>In other words, I don't want PHP to be able to run any (dangerous) program  found in the filesystem, such as /bin/ls, /usr/bin/wget and so on.</p>

<p>Edit: It's not a problem to trust or not the user input. I know that my PHP scripts runs the legitimate program. I worry about the capability offered to malicious PHP scripts to run everything through a shell exec.</p>

<p>It seems that PHP doesn't allow to specify the file names that can be executed, but is there any workaround to limit the execution? Maybe writing a customized PHP extension?</p>