If you allow sudo execution for chmod by "nobody" (www,
webdaemon, httpd, whatever user php is running under)in this manner, it had
better be a system on which the owner is able to be root and no one else
can run code, else your whole system is compromised. Someone could change
the mode of /etc/passwd or the shadow password file.
Other system
commands (sudo mount) and so forth are similar.