allow www-data some system commands via sudo