Restricted compile/execute mode

[Duck <duck@...>]

Let's say I want to have an .INI-file-style or a Firefox-style 
configuration file, with a list of setting, e.g. like this:

server.name = "example.org"
server.settings.port = 45
server.settings.timeout = 9
server.settings.softfruit = "mango"
. . .

I'd much rather simply allow the config file to be written in Lua, perhaps 
like this:

server = {
   name = "example.org"
   settings = { port = 45, timeout = 9, softfruit = "mango" }
}

not least because it save me doing the parsing, and maps directly and 
clearly onto the final internal representation of the config data.

Is there an easy way to restrict the behaviour of the configuration code? 
For example, so that only code which initialises tables, numbers and 
strings will be compiled? (E.g. to stop functions being defined and 
invoked during configuration.) And so that only new tables can be assigned 
into? (E.g. to stop configuration trouble such as "io.stdout = 7".)

A token filter seems like a possible (but vulnerability-prone) way to go; 
some sort of stripped down Lua state might be another.

Any pointers or example code?