Additional access required for passenger_t
sandbox domains should be allowed to use libraries which require execmod