Alas, I have to restore 'marshal', since it is needed by the new
cPickle-compatible pickle, and pickle must be importable in restricted
mode.  I guess I'll have to make marshal safe.
diff --git a/Lib/rexec.py b/Lib/rexec.py
index 29b9ad6..a548e24 100644
--- a/Lib/rexec.py
+++ b/Lib/rexec.py
@@ -21,7 +21,6 @@
 import sys
 import __builtin__
 import os
-import marshal
 import ihooks
 
 
@@ -133,7 +132,7 @@
 
     ok_builtin_modules = ('audioop', 'array', 'binascii',
 			  'cmath', 'errno', 'imageop',
-			  'math', 'md5', 'operator',
+			  'marshal', 'math', 'md5', 'operator',
 			  'parser', 'regex', 'rotor', 'select',
 			  'strop', 'struct', 'time')