only call exec() if allowed to

fixes #10008 

@karlitschek @icewind1991 @bantu please review - THX