use forbid/permit on execsmp