SuEXEC

The Apache module mod_suexec serves to allow CGI programs to run in a protected environment.

About a layered approach one becomes the prevents unsafe programs are executed at all, on the other executable programs to be started only under defined user IDs and with a limited command set.