I tend to address this by allowing the process that runs the server, in this case the webserver, to execute the relevant command, and only that command, via passwordless sudo.
For example, here's my sudoers entry to allow a user called NAGIOS (who runs my local monitoring server) to execute a plugin that checks that RAID hardware as root:
nagios ALL=(root) NOPASSWD: /usr/lib/nagios/plugins/check_md_raid
You would have something similar, perhaps:
apache ALL=(root) NOPASSWD: /sbin/service dnsmasq restart
To address your concerns above, this doesn't allow anyone who can subvert the apache process to run
sudo shutdown -h now, or even
sudo service dnsmasq stop. It only allows exactly what's specified in the sudoers file.
It's true that if the
service command is badly written, and if someone can find a way to make running
service dnsmasq stop as root via sudo change the mode on the
passwd file, or start an allow-all
sshd on port 22222, or indeed do anything nefarious, then you have a problem. But in such a case you have a problem however you run the service command as root, whether it's via sudo or any other mechanism.
sudo does its best to sanitise the environment, and the service command is a stock part of most GNU/Linuxes (and has been for some time) and therefore probably has no obvious holes.
service command via passwordless
sudo is no less safe than any other method of running it, and probably more safe than many home-brewed or other less-well-tested ways.