openclaw - 💡(How to fix) Fix exec allowlist pattern matching broken — commands with args fail with allowlist miss [1 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#61451Fetched 2026-04-08 02:58:27
View on GitHub
Comments
0
Participants
1
Timeline
1
Reactions
0
Author
Participants
Timeline (top)
renamed ×1

Fix Action

Fix / Workaround

Impact:

  • User cannot execute allowed commands
  • Workaround: manual VPS restart
  • Manual JSON fix does not resolve the bug
RAW_BUFFERClick to expand / collapse

Bug: exec allowlist pattern matching broken

When a command has arguments (like 'find / -name something'), the allowlist check fails with 'allowlist miss' even when the exact entry exists in exec-approvals.json.

Reproduction:

  1. Add entry to allowlist (e.g. '/usr/bin/find')
  2. Run command with args (e.g. 'find / -name something')
  3. Result: allowlist miss

Observed behavior:

  • cat → works (wildcard * matches)
  • echo → works
  • find without args → works
  • find WITH args → allowlist miss
  • Wildcard * does not match commands with arguments

Probable cause: Pattern matching code in OpenClaw exec approval system does not correctly parse commands with arguments. The file exec-approvals.json can become corrupted after manual edits.

Impact:

  • User cannot execute allowed commands
  • Workaround: manual VPS restart
  • Manual JSON fix does not resolve the bug

Environment:

  • OpenClaw on VPS
  • Config: /root/.openclaw/openclaw.json
  • Approvals: /root/.openclaw/exec-approvals.json

Logs and context: See daily memory at /root/.openclaw/workspace/memory/2026-04-02.md

extent analysis

TL;DR

The issue can be worked around by modifying the exec-approvals.json file to include the exact command with arguments or using a wildcard pattern that matches the command and its arguments.

Guidance

  • Verify that the exec-approvals.json file is correctly formatted and not corrupted, as manual edits can cause issues.
  • Try adding the exact command with arguments to the allowlist, e.g., '/usr/bin/find *', to see if it resolves the issue.
  • Check the OpenClaw documentation for any specific guidelines on pattern matching and allowlist configuration.
  • Consider reaching out to the OpenClaw community or support for further assistance, as the issue may be related to a bug in the pattern matching code.

Example

No code snippet is provided as the issue is related to configuration and pattern matching, and the exact solution depends on the specific use case.

Notes

The provided workaround of manually restarting the VPS may resolve the issue temporarily, but it does not address the underlying problem. The exec-approvals.json file corruption issue should be investigated further to prevent similar problems in the future.

Recommendation

Apply workaround: Modify the exec-approvals.json file to include the exact command with arguments or use a wildcard pattern, as this is the most straightforward way to resolve the issue without waiting for a potential fix from the OpenClaw team.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

openclaw - 💡(How to fix) Fix exec allowlist pattern matching broken — commands with args fail with allowlist miss [1 participants]