8 replies

Title: Persistent "Exec denied (approval-timeout)" on Ubuntu 24.04 (Similar to #21083)

✅Solved

Bug Report: Persistent Exec denied (approval-timeout) Error
I am facing the persistent Exec denied (approval-timeout) error on all exec commands in OpenClaw, blocking any interaction via terminal. The problem is identical to that reported in Issue #21083 (marked as resolved), but persists even after extensive troubleshooting.

The Critical Symptom:
The default_api.exec returns "success" to the agent, but the OpenClaw Gateway immediately sends a [System Message] confirming that the command was denied due to a timeout.

Environment:

Version (CLI & Gateway): 2026.2.24 (Synchronized)

OS: Ubuntu 24.04 LTS (VPS) | Node.js: v22.22.0

Config: allowlist configured, security: "allowlist", auto_approve_allowlist: true.

Already tried:

openclaw doctor --fix and complete reinstallation via npm.

Clock synchronization check (timedatectl).

Cleaning sockets in /tmp/openclaw* and orphaned processes.

Forcing a systemd rebuild --user unit file.

The openclaw exec command via CLI returns error: unknown command 'exec', although it appears in --help.

Main Topics (Summary)
Approval Mechanism Failure: Commands in allowlist timeout even with auto_approve enabled. False Positive Response: The API reports success to the agent before the actual denial from the Gateway.

CLI Inconsistency: The exec command is not recognized by direct execution via the terminal, suggesting a parsing error in the binary.

Regression from Issue #21083: Symptoms indicate that the previous fix may not cover the Ubuntu 24.04 environment or version 2026.2.x.

Solution

That “tool returns success, then Gateway posts

Exec denied (approval-timeout)

Exec denied (approval-timeout)

” is almost always not a false-positive exec — it’s the exec approvals flow doing what the docs describe: when a prompt is required, exec returns immediately with an approval id / pending status, and the final allow/deny arrives later as a system event. If nobody/nowhere approves it before the timeout, you get

approval-timeout

approval-timeout

.
Docs: https://docs.openclaw.ai/tools/exec-approvals and https://docs.openclaw.ai/tools/exec

1) The #1 cause of “timeout even though I have an allowlist”

Your command is still being treated as “approval required”, which happens when either:

-

ask=always

ask=always

(so it always prompts, even for allowlisted commands), or
- the allowlist doesn’t match (common because allowlist matching is on resolved binary path, not basenames —

ls

ls

bash

bash

entries are ignored; you need

/usr/bin/ls

/usr/bin/ls

, etc.), or
- you edited the allowlist on the wrong host:

openclaw approvals

openclaw approvals

defaults to the local approvals file unless you target the gateway/node explicitly.

Key detail from docs: allowlists are per-agent, and patterns should resolve to binary paths (basename-only entries are ignored).

2) What I’d check next (paste output if you can)

Run these on the machine that is actually executing host exec (your VPS if

host=gateway

host=gateway

bash

bash

Jump to solution

FotC�

Friends of the Crustacean 🦞🤝•2w ago•

8 replies

Jarlisson

Title: Persistent "Exec denied (approval-timeout)" on Ubuntu 24.04 (Similar to #21083)

✅Solved

The Critical Symptom:
The default_api.exec returns "success" to the agent, but the OpenClaw Gateway immediately sends a [System Message] confirming that the command was denied due to a timeout.

Environment:

Version (CLI & Gateway): 2026.2.24 (Synchronized)

OS: Ubuntu 24.04 LTS (VPS) | Node.js: v22.22.0

Config: allowlist configured, security: "allowlist", auto_approve_allowlist: true.

Solution

That “tool returns success, then Gateway posts

Exec denied (approval-timeout)

Exec denied (approval-timeout)

approval-timeout

approval-timeout

.
Docs: https://docs.openclaw.ai/tools/exec-approvals and https://docs.openclaw.ai/tools/exec

1) The #1 cause of “timeout even though I have an allowlist”

Your command is still being treated as “approval required”, which happens when either:

-

ask=always

ask=always

(so it always prompts, even for allowlisted commands), or
- the allowlist doesn’t match (common because allowlist matching is on resolved binary path, not basenames —

ls

ls

bash

bash

entries are ignored; you need

/usr/bin/ls

/usr/bin/ls

, etc.), or
- you edited the allowlist on the wrong host:

openclaw approvals

openclaw approvals

2) What I’d check next (paste output if you can)

Run these on the machine that is actually executing host exec (your VPS if

host=gateway

host=gateway

bash

bash

Jump to solution

Title: Persistent "Exec denied (approval-timeout)" on Ubuntu 24.04 (Similar to #21083)

1) The #1 cause of “timeout even though I have an allowlist”

2) What I’d check next (paste output if you can)

Title: Persistent "Exec denied (approval-timeout)" on Ubuntu 24.04 (Similar to #21083)

1) The #1 cause of “timeout even though I have an allowlist”

2) What I’d check next (paste output if you can)

Similar Threads

Similar Threads

Similar Threads