exec-allowlist
Only allowed programs run
shipped
The sections below are generated from the CLI (methodology 0.3-draft, CLI 0.3.0); the same text is printed by sealmark explain exec-allowlist.
- pack
execopt-in pack- weight
- advisory · not scored
- scope
- server (which programs the tool will start)
- decided by
- fs-observerresponse
- since
- 0.2-draft (methodology 0.3-draft)
- config keys
activechecks.exec-allowlist.enabledchecks.exec-allowlist.severity
Probes
unlistedprogram sm-canary, a harmless program that is not one the server could have listed; running it means there is no allowlist
Settings and thresholds
Every check also takes checks.exec-allowlist.enabled and checks.exec-allowlist.severity; they are described once in the configuration reference.
This check has no numeric threshold.
| Key | Default | Standard | Meaning |
|---|---|---|---|
active | false | not locked | Allow the exec pack and active custom probes to run harness-owned programs. Only the --active flag can set it; files and environment cannot. |
How the verdict is established
- Scoring. advisory: reported with its verdict but not part of the score.
What to fix
Allow only an explicit list of program names and refuse everything else. This check is advisory; a general-purpose command tool has no allowlist by design.
False positives
A general-purpose command tool has no allowlist by design; this is advice, not a defect, and it is not scored.
False negatives
An allowlist that happens to include the harness program name would read as 'no allowlist'.