### Please describe the problem.

Trying to replace my rrsync setup with a restricted git-annex-shell, I ran into the following problem (slightly obfuscated):

    ± git annex get .
    get secret (from secrets...) 
    git-annex-shell: Only allowed to access ~/store not ~/store/secrets/6a8/d0c/GPGHMACSHA1--0000000000000000000000000000000000000000/GPGHMACSHA1--0000000000000000000000000000000000000000
    rsync: connection unexpectedly closed (0 bytes received so far) [Receiver]
    rsync error: error in rsync protocol data stream (code 12) at io.c(235) [Receiver=3.1.2]

It does not matter if GIT_ANNEX_SHELL_DIRECTORY is just "store", "store/secrets" or the full absolute path to any of the two directories, the output and the results are the same.


### What steps will reproduce the problem?

Create an encrypted rsync remote in ~/store/secrets, add

    restrict,command="GIT_ANNEX_SHELL_DIRECTORY=store GIT_ANNEX_SHELL_LIMITED=true GIT_ANNEX_SHELL_READONLY=true git-annex-shell -c \"$SSH_ORIGINAL_COMMAND\"" ssh-rsa ...

to ~/.ssh/authorized keys and try to retrieve files.


### What version of git-annex are you using? On what operating system?

git-annex version: 6.20180227-g32d682dd8 (standalone version) on Debian stretch


### Have you had any luck using git-annex before?

As always, I'm a fan :>