AlexxIT/go2rtc · error

echo: bin not in allow_paths:

Error message

echo: bin not in allow_paths: 

What it means

The echo stream source runs an external binary from a URL of the form echo:BIN ARGS. For security, when the allow_paths whitelist is configured, only binaries listed in it may be executed. This error means the requested binary (args[0]) is not in that whitelist, so the redirect is refused.

Solutions

1. Add the exact binary name/path used in the echo: URL to allow_paths in the config
2. Make the binary reference in the echo: URL match the allow_paths entry exactly (same absolute path or same name)
3. If the URL is echo: with no command, fix the URL to include a binary
4. If any binary should be allowed, remove the allow_paths restriction entirely (not recommended)

Example fix

// before
streams:
  cam1: echo:ffmpeg -i ... 
allow_paths: ["/usr/bin/ffmpeg"]
// after
allow_paths: ["/usr/bin/ffmpeg", "ffmpeg"]  # or use the full path in the echo: URL

bin := strings.SplitN(url[5:], " ", 2)[0]
if allowPaths != nil && !slices.Contains(allowPaths, bin) { return fmt.Errorf("bin %q not allowed", bin) }

u, err := streams.Get(url); if err != nil && strings.Contains(err.Error(), "allow_paths") { /* log which bin to add to allow_paths */ }

When it happens

Trigger: A stream source like echo:mybin arg1 where allow_paths is non-nil and does not contain "mybin". Note the allowlist is matched exactly; the trailing space in the message shows an empty bin when the echo: URL has no command (e.g. echo: with empty suffix).

Common situations: Typo in the binary name in the stream URL; binary referenced by bare name while allow_paths lists a full path (or vice versa); echo: URL missing the command after the prefix; allow_paths set in config but new command added later without updating it.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• exec: bin not in allow_paths:
• exec: rtsp module disabled
• config file disabled
• exec: timeout
• expr: result is empty

AI-assisted analysis of AlexxIT/go2rtc@c245815e75 (2026-09-07). Data as JSON: /api/errors/924d0a40daad8916. Report an issue: GitHub.

Appendix: source

Thrown at internal/echo/echo.go:31

func Init() {
	var cfg struct {
		Mod struct {
			AllowPaths []string `yaml:"allow_paths"`
		} `yaml:"echo"`
	}

	app.LoadConfig(&cfg)

	allowPaths := cfg.Mod.AllowPaths

	log := app.GetLogger("echo")

	streams.RedirectFunc("echo", func(url string) (string, error) {
		args := shell.QuoteSplit(url[5:])

		if allowPaths != nil && !slices.Contains(allowPaths, args[0]) {
			return "", errors.New("echo: bin not in allow_paths: " + args[0])
		}

		b, err := exec.Command(args[0], args[1:]...).Output()
		if err != nil {
			return "", err
		}

		b = bytes.TrimSpace(b)

		log.Debug().Str("url", url).Msgf("[echo] %s", b)

		return string(b), nil
	})
	streams.MarkInsecure("echo")
}

View on GitHub (pinned to c245815e75)