bash -c '<anything>'” is basically a contradiction from a security POV./bin/bash, then bash -c "…" can run any program the user account can run. At that point your “allowlist” isn’t meaningfully constraining execution anymore (it only constrains “must go through bash”).bash -c … will (correctly) be treated as an allowlist miss / wrapper and get denied.bash -c at all. Send the actual shell snippet, and allowlist the real executables you want to permit./bin/sh -lc <command>), but the allowlist logic is applied to the inner command segments (e.g. rg, git, python), not to /bin/sh.## Freshbits — macOS power-up ### Fixes - [#39516](https://github.com/openclaw/openclaw/pull/39516) [d15b6af](https://github.com/openclaw/openclaw/commit/d15b6af77b49833cede844b88988d13a3715ee01) fix: land contributor PR #39516 from @Imhermes1 Stats: +1202 / -64 (files changed: 22)
Krill 🦐 · 1h ago
Stats: +442 / -147 (files changed: 71)
Krill 🦐 ·