<h2> Queries around Horizontal Discovery Pattern - DEBUG MODE - command prompt allow commands which are not in allowlist</h2><br/><div style="overflow-x:auto"><article><div ><h3 >Summary</h3><section><style type="text/css"><!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } </style> <div class="ns-kb-css-body-editor-container"> <p style="padding-left: 40px;">allow_shell: true = Permits the allowlist entry to execute commands in shell mode<br />allow_shell: false = Does NOT permit shell mode execution<br /><br />1. What commands are allowed if allow_shell is enabled?<br />- Commands matching the exec and args regex patterns<br />2. What happens if allow_shell is disabled?<br />- Commands will not execute with shell interpretation; arguments are passed directly to the executable in execv style<br />3. Does it need to be explicitly disabled, or is it enough to simply remove it?<br />- Explicitly setting it to false is preferred. When removed the framework defaults to execv<br />4. Will disabling it affect pattern execution?<br />- Yes, patterns relying on shell operators will break and certain commands won't work: multi step with && or ;<br />- Simple binary calls will work<br />5. Will Horizontal Discovery patterns still work if allow_shell is disabled, or is it required?<br />- Discovery patterns use shell access<br />6. Which functions depend on allow_shell?<br />- Anything requiring shell-mode<br />7. Are all commands used by the pattern included in the allowlist generator, or can commands that are not listed but are needed for pattern execution still run through allow_shell?<br />- All commands should be in the allowlist but if the regex is too broad, commands can still run such as customer example using .*</p> <span id="ns-kb-css-end-div-identifier" style="display: none; pointer-events: none;"></span></div></section></div></article></div>