Thanks for suggestion André. :-)

Yes, we will take whitelisting approach only.

Rather than giving direct command like "nginx -t && service nginx reload" in sudoers list, we will create a small shell script, put it outside web-writable path (so php/web-scripts cannot alter it)

www-data user will have sudo privilege on our script only

--
Rahul Bansal
EasyEngine - https://github.com/rtCamp/easyengine