file descriptor access limited to 1,2 & those created by worker

Issue #20

A potentially cleaner (albeit slower) approach is to just do this in a
policy and allow multiple pre/post policies on filesystem.