Sendmail has a program called smrsh that restricts what binaries can be run from sendmail aliases. Is there something like this in Exim ?

Check out the allow_commands option in the pipe transport.

---