Drush policy restriction doesn't restrict sql_sync On my @dev machine, I've installed a drush policy rule that should (?) prevent sql_sync to my remote @prod machine,

cat /etc/drush/policy.drush.inc
    &lt;?php
    function drush_policy_sql_sync_validate($source = NULL, $destination = NULL) { 
        if ($destination == '@prod') {
            return drush_set_error(dt('POLICY: sql_sync TO @prod is NOT allowed')) 
        }
    }


When I attempt the sql_sync, instead of preventing the action and printing the error, it allows it,

drush -v sql-sync --simulate=0 @dev @prod
    Loaded alias @defaults from file /etc/drush/aliases.drushrc.php                                [notice]
    Loaded alias @prod from file /etc/drush/aliases.drushrc.php                                    [notice]
    Loaded alias @dev from file /etc/drush/aliases.drushrc.php                                     [notice]
    /home/drupal/drush/drush  --backend=2 --verbose --uri=https://dev.mydomain.com                 [notice]
    --root=/home/drupal/dev  sql-conf   --all 2&gt;&amp;1
    ssh -o PasswordAuthentication=no root@prod.mydomain.com 'drush  --backend=2 --verbose          [notice]
    --uri=https://prod.mydomain.com --root=/home/drupal/prod  sql-conf   --all
    2&gt;&amp;1' 2&gt;&amp;1
    Modification time of local dump file /home/drupal/drush-dumps/sql-sync-dev.sql is less than 24 hours [warning]
    old. Use the --no-cache option to force a refresh.

    You will destroy data in prod.mydomain.com/prodDB and replace with data from devDB.

    You might want to make a backup first, using the sql-dump command.

    Do you really want to continue? (y/n): y
    Calling system(rsync -e 'ssh ' -akzv --exclude=".git" --exclude=".gitignore" --exclude=".hg" --exclude=".hgignore" --exclude=".hgrags" --exclude=".bzr" --exclude=".bzrignore" --exclude=".bzrtags" --exclude=".svn" --stats --progress /home/drupal/drush-dumps/sql-sync-dev.sql root@prod.mydomain.com:/home/drupal/drush-dumps/sql-sync-prod.sql);
    sending incremental file list

    Number of files: 1
    Number of files transferred: 0
    Total file size: 14634184 bytes
    Total transferred file size: 0 bytes
    Literal data: 0 bytes
    Matched data: 0 bytes
    File list size: 37
    File list generation time: 0.001 seconds
    File list transfer time: 0.000 seconds
    Total bytes sent: 46
    Total bytes received: 12

    sent 46 bytes  received 12 bytes  38.67 bytes/sec
    total size is 14634184  speedup is 252313.52
    Calling system(ssh -o PasswordAuthentication=no root@prod.mydomain.com 'mysql --database=prodDB --host=127.0.0.1 --user=dbadmin --password=secretpassword --silent &lt; /home/drupal/drush-dumps/sql-sync-prod.sql 2&gt;&amp;1');
    Command dispatch complete                                                                      [notice]


What do I need to change/add to get the policy to restrict the sql_sync?
I added this to my sync_enable commandfile, and it definitely worked:

function drush_sync_enable_sql_sync_validate($source = NULL, $destination = NULL) {
  if (strpos($destination, 'live')) {
    return drush_set_error('DRUSH_BAD_DEVOPS_NO_BISCUIT', dt("Don't sync to live."));
  }
}


That looks the same as what you've got, so the next thing I'd recommend that you try is drush cc drush, to clear the Drush commandfile cache.  That will insure that Drush can see your policy file.

UPDATE:

Sorry, the problem was that Drush looks for site-wide commandfiles in '/usr/share/drush/commands', not '/etc/drush'.  Move your policy file there, and then drush cc drush, and it should work.