bash deny rules don't apply through wrappers (time, env, bash -c) on v2 #62513

Activity

1. opencodejr commented on Nov 7, 2026

   

   opencodejrBot

   on Nov 7, 2026

   Contributor

   More actions

   Thanks for testing this on v2 and for the full list of wrappers.

   I think this is a duplicate of #58775. That issue reports the same thing on v2: shell deny rules are matched against the literal command text, so env …, command …, FOO=1 … or a path-qualified binary gets past the deny. It has been reproduced on dev, and a contributor has proposed a fix there that would also check deny rules against the command with its wrapper removed.

   Possible duplicates and related issues, ordered from most to least likely:

   • permissions: rule matching depends on spelling (shell deny bypass, inert absolute rules) #58775: same root cause on v2 (wrappers, prefixes and variable assignments bypass shell deny rules); open, reproduced, fix under discussion
   • bash permission patterns match only each command's own text, so a wrapper passes a deny rule written for the inner command #54008: your earlier v1 report of the same wrapper bypass, closed as v1-only
   • shell/webfetch policy resources match raw strings — argv tokenization and URL host normalization needed (evasion classes un-enumerable) #55232: request to match shell policy rules on parsed command arguments instead of the raw string, which would also close wrapper and quoting bypasses
   • bash: recursive file-reading commands (grep -r, rg, ls -R) bypass filename-pattern deny rules #56545: a related bypass where recursive commands (grep -r, rg, ls -R) get past filename-pattern deny rules

   Some of your cases aren't listed in #58775 yet: time, nohup, timeout, the command inside bash -c / sh -c, xargs, find -exec, and "Allow always" saving the wrapper pattern (time *, bash *, find *). Adding them there would help make sure the fix covers them.

   The bot will close this issue as a duplicate in 1 day unless you reply explaining how your problem is different.
2. opencodejr

   added

   pending close

   triaging

   on Nov 7, 2026
3. Project579 commented on Nov 7, 2026

   

   Project579

   on Nov 7, 2026

   Author

   More actions

   Duplicate of #58775, closing. I'll add the extra cases there.
4. Project579

   closed this as a duplicateof permissions: rule matching depends on spelling (shell deny bypass, inert absolute rules) #58775 on Nov 7, 2026
5. opencodejr commented on Nov 7, 2026

   

   opencodejrBot

   on Nov 7, 2026

   Contributor

   More actions

   Thanks for confirming, and for moving the extra cases (time, nohup, timeout, bash -c, xargs, find -exec, and the "Allow always" wrapper pattern) over to #58775. Having them there should help make sure the fix covers them.
6. opencodejr commented on Nov 8, 2026

   

   opencodejrBot

   on Nov 8, 2026

   Contributor

   More actions

   Closing this as a duplicate of #58775, as you suggested. The extra wrapper cases (time, nohup, timeout, bash -c, xargs, find -exec) and the "Allow always" wrapper pattern are best tracked there, alongside the fix being discussed. Thanks again for the thorough report.