secure the use of exec("mysqldump")

I wonder if it is possible to secure the use of exec("mysqldump").

I am tightening the security of my Drupal web server and when I moved to PHP-FPM the default install prohibited the use of the exec() function which broke my use of backup_migrate. When I searched my Drupal codebase I was surprised that there were only 4 uses of exec() in my whole codebase with this as one of them.

There is probably no alternative, but I thought it would be worth asking. As long as this command stands the way it is then exec() must be available and also one must allow PHP access to '/usr/bin' and all the commands with in '/usr/bin'. This is a potential security risk because open_basedir cannot be used to prevent PHP access to '/usr/bin' without some custom efforts.

Possible solutions...

1. Maybe there is a PHP library that provides access to this function, so exec() no longer needed
2. Copy the mysqldump exe into the Drupal webroot, so that exec() can be used, but still restricted from /usr/bin.

Other ideas?