Module policy 

policy.rs — pure security core for the exec component.

Functions

build_env

Build the child env: start empty, copy allow-listed host vars, apply set, then strip anything matching deny_env globs (deny wins, applied last).

eval_args

Validate an args slice against the profile’s policy. Per-element. Order: deny_flags first, then allow mode. Empty slice always passes.

is_known_shell

Defense-in-depth: reject known shells unless allow_shell.