DenyExecSync can be init-only