only call exec() if allowed to