[tremon]

Specifically for these kind of situations, sudo has the NOEXEC tag: it preloads a dummy library that null-routes all exec calls to prevent this kind of shell leak.