Allow some pre-/post-xfer exec shell restrictions.