{"record":{"id":"94b4fe956bc9079c","repo":"ruvnet/ruflo","slug":"sudo-not-allowed","errorCode":"SUDO_NOT_ALLOWED","errorMessage":"Sudo commands are not allowed","messagePattern":"Sudo commands are not allowed","errorType":"exception","errorClass":"SafeExecutorError","httpStatus":null,"severity":"error","filePath":"v3/@claude-flow/security/src/safe-executor.ts","lineNumber":242,"sourceCode":"    const basename = path.basename(command);\n\n    // Check if command is allowed\n    const isAllowed = this.config.allowedCommands.some(allowed => {\n      const allowedBasename = path.basename(allowed);\n      return command === allowed || basename === allowedBasename;\n    });\n\n    if (!isAllowed) {\n      throw new SafeExecutorError(\n        `Command not in allowlist: ${command}`,\n        'COMMAND_NOT_ALLOWED',\n        command\n      );\n    }\n\n    // Check for sudo\n    if (!this.config.allowSudo && (command === 'sudo' || basename === 'sudo')) {\n      throw new SafeExecutorError(\n        'Sudo commands are not allowed',\n        'SUDO_NOT_ALLOWED',\n        command\n      );\n    }\n  }\n\n  /**\n   * Validates command arguments for injection patterns.\n   *\n   * @param args - Arguments to validate\n   * @throws SafeExecutorError if arguments contain dangerous patterns\n   */\n  private validateArguments(args: string[]): void {\n    for (const arg of args) {\n      // Check for null bytes\n      if (arg.includes('\\0')) {\n        throw new SafeExecutorError(","sourceCodeStart":224,"sourceCodeEnd":260,"githubUrl":"https://github.com/ruvnet/ruflo/blob/fa13ee4ad60ac2090b1480656eb233521790d640/v3/@claude-flow/security/src/safe-executor.ts#L224-L260","documentation":"SafeExecutor.validateCommand matched the command to the allowlist but it is 'sudo' and config.allowSudo is false. Privilege escalation via the executor is explicitly opted out of, so even an allowlisted sudo invocation is refused.","triggerScenarios":"Thrown at v3/@claude-flow/security/src/safe-executor.ts:242 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Remove sudo from the command; run the process with the required privileges instead.","Use a narrowly-scoped privilege mechanism (capabilities, setuid wrapper) outside the executor."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"fa13ee4ad60ac2090b1480656eb233521790d640","analyzedAt":"2026-08-18T21:34:22.708Z","contentChangedAt":"2026-08-18T21:34:22.708Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}