Expand description
The plugin’s environment: the daemon user’s login environment reduced to
HOME, USER, LOGNAME, PATH (the login shell’s), LANG, LC_*,
TMPDIR and SHELL (all of it under machine.full). Children spawned
through process inherit exactly these; the daemon’s own environment
never reaches a plugin. No grant.