It is fine that rrsync has a good set of default not allowed args for rsync, but it would be very helpful, if this can be configured too. Either by config or cmdline. A restricted shell should also match the needs. I would like to control short_disabled, short_disable_subdir and long_opts.