This is rewritten version of core-admin-linux/qrexec/qrexec-policy. It's placed outside of `qubes` module on purpose - to avoid imporing it, which require a lot of time. QubesOS/qubes-issues#865 QubesOS/qubes-issues#910
