My mistake - I was looking in the PHP .ini documentation for "Security 
and Safe Mode".  Apparently, disable_functions is in the "Core" 
section.  The PHP documentation is not all that great in this area.

I admitted I was wrong about escapeshellcmd(), but I suggest you take 
the time to read about how to use 'disable_functions' in PHP ;)

And what Jan said: how in the world is escapeshellcmd() a potentially 
dangerous function?  suhosin is crap.

You are wrong.  Of course it has to do with suhosin.  PHP provides NO 
way of disabling these functions.

I've just read the doc and I agree. All it seems to be doing is parse 
strings, so there shouldn't be any issues. I always thought this would 
actually run commands, but it was just part of a 'global rule' that 
used to include exec().

I still think it should be mentioned somewhere that s/mime needs 
exec() and escapeshellcmd(), because after doing a quick search it 
seems quite a few forums recommend people disable those, but maybe 
this report is enough since it's public.

And what makes escapeshellcmd a dangerous function? It *increases* 
security. Disabling it is completely insane.

This has *nothing* to do with suhosin. It's standard practice to block 
dangerous php functions at the server level and it would just be nice 
if the use of those special functions could be documented.

This is not something we are going to document.  Suhosin is *not* a 
part of basic PHP.  If people are running patched versions of PHP, 
they are responsible for configuring correctly.

We already recommend that people disable suhosin because it is broken anyway.

It's disabled for Horde, but that command was blocked server wide to 
prevent abuse. So it's not easy to workaround that when not using 
php-fpm, but I don't think there is a way around using escapeshellcmd 
to call openssl.

Please, please, please, please tell me you are not using suhsoin.

Switched to debug mode and found out why

2011-07-07T19:17:13+01:00 WARN: HORDE [imp] PHP ERROR: 
escapeshellcmd() has been disabled for security reasons [pid 78964 on 
line 1213 of "/usr/local/lib/php/Horde/Crypt/Smime.php"]

So I have 2 suggestions:
1) Add something in the documentation that escapeshellcmd() is needed 
if we plan on using S/MIME
2) PHP errors should raise Horde errors, not a warnings. I was only 
able to see this message after I've changed the logging level

The path to openssl is correct, but horde can't import S/MIME certs.
This is the error in Apache logs:
pkcs12: not found