{"record":{"id":"0c33bd7b8a9aa56b","repo":"AlexxIT/go2rtc","slug":"exec-bin-not-in-allow-paths","errorCode":null,"errorMessage":"exec: bin not in allow_paths: ","messagePattern":"exec: bin not in allow_paths: ","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/exec/exec.go","lineNumber":92,"sourceCode":"\tif i := strings.Index(rawURL, \"{output}\"); i > 0 {\n\t\tif rtsp.Port == \"\" {\n\t\t\treturn nil, errors.New(\"exec: rtsp module disabled\")\n\t\t}\n\n\t\tsum := md5.Sum([]byte(rawURL))\n\t\tpath = \"/\" + hex.EncodeToString(sum[:])\n\t\trawURL = rawURL[:i] + \"rtsp://127.0.0.1:\" + rtsp.Port + path + rawURL[i+8:]\n\t}\n\n\tcmd := shell.NewCommand(rawURL[5:]) // remove `exec:`\n\tcmd.Stderr = &logWriter{\n\t\tbuf:   make([]byte, 512),\n\t\tdebug: log.Debug().Enabled(),\n\t}\n\n\tif allowPaths != nil && !slices.Contains(allowPaths, cmd.Args[0]) {\n\t\t_ = cmd.Close()\n\t\treturn nil, errors.New(\"exec: bin not in allow_paths: \" + cmd.Args[0])\n\t}\n\n\tif s := query.Get(\"killsignal\"); s != \"\" {\n\t\tsig := syscall.Signal(core.Atoi(s))\n\t\tcmd.Cancel = func() error {\n\t\t\tlog.Debug().Msgf(\"[exec] kill with signal=%d\", sig)\n\t\t\treturn cmd.Process.Signal(sig)\n\t\t}\n\t}\n\n\tif s := query.Get(\"killtimeout\"); s != \"\" {\n\t\tcmd.WaitDelay = time.Duration(core.Atoi(s)) * time.Second\n\t}\n\n\tif query.Get(\"backchannel\") == \"1\" {\n\t\treturn pcm.NewBackchannel(cmd, query.Get(\"audio\"))\n\t}\n","sourceCodeStart":74,"sourceCodeEnd":110,"githubUrl":"https://github.com/AlexxIT/go2rtc/blob/c245815e75e2a5fd60b4290f12bfc04e55a984d3/internal/exec/exec.go#L74-L110","documentation":"The exec stream source launches external binaries; for safety, if allow_paths is configured, only whitelisted executables may be started. This error means the binary that exec is about to spawn (cmd.Args[0]) is not in that whitelist, so the handler aborts and closes the command.","triggerScenarios":"A stream source exec:BIN ... where allow_paths is non-nil and does not exactly contain BIN (cmd.Args[0]). Includes cases where the URL's binary resolves differently (bare name vs absolute path) than the allowlist entry.","commonSituations":"After adding allow_paths to the config for the echo module, exec sources break because they use different binaries; binary path changed after a system update; typo in the exec URL; allowlist uses relative name while exec URL uses absolute path.","solutions":["Add the exact executable path/name from the exec: URL to allow_paths","Match formats: if the exec URL uses a bare name, allow the name; if absolute, allow the absolute path","If the binary moved, update either the stream URL or the allowlist entry","Remove allow_paths if per-binary restriction is not needed (not recommended)"],"exampleFix":"// before\nallow_paths: [\"/usr/bin/ffmpeg\"]\nstreams:\n  cam: exec:/usr/local/bin/ffmpeg ...\n// after\nallow_paths: [\"/usr/bin/ffmpeg\", \"/usr/local/bin/ffmpeg\"]","handlingStrategy":"validation","validationCode":"if allowPaths != nil && !slices.Contains(allowPaths, bin) { return fmt.Errorf(\"add %q to allow_paths\", bin) }","typeGuard":null,"tryCatchPattern":"_, err := streams.Get(url); if err != nil && strings.Contains(err.Error(), \"allow_paths\") { /* resolve binary path and extend allowlist */ }","preventionTips":["Generate allow_paths from the same list of binaries used in exec: sources","After system upgrades, verify binary paths referenced by exec sources still exist","Use absolute paths consistently in both URLs and allowlist"],"tags":["security","whitelist","exec","go2rtc"],"backgroundTag":"permission-denied","analyzedSha":"c245815e75e2a5fd60b4290f12bfc04e55a984d3","analyzedAt":"2026-09-07T11:47:02.965Z","contentChangedAt":"2026-09-07T11:47:02.965Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}