{"record":{"id":"e884f37f4407d297","repo":"hashicorp/nomad","slug":"q-is-not-in-args-allowlist","errorCode":null,"errorMessage":"%q is not in args_allowlist","messagePattern":"%q is not in args_allowlist","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"drivers/qemu/driver.go","lineNumber":448,"sourceCode":"\t\t\treturn fmt.Errorf(\"'%s' is not an allowed emulator\", emulator)\n\t\t}\n\t}\n\treturn nil\n}\n\n// validateArgs ensures that all QEMU command line params are in the\n// allowlist. This function must be called after all interpolation has\n// taken place.\nfunc validateArgs(pluginConfigAllowList, args []string) error {\n\tif len(pluginConfigAllowList) > 0 {\n\t\tallowed := map[string]struct{}{}\n\t\tfor _, arg := range pluginConfigAllowList {\n\t\t\tallowed[arg] = struct{}{}\n\t\t}\n\t\tfor _, arg := range args {\n\t\t\tif strings.HasPrefix(strings.TrimSpace(arg), \"-\") {\n\t\t\t\tif _, ok := allowed[arg]; !ok {\n\t\t\t\t\treturn fmt.Errorf(\"%q is not in args_allowlist\", arg)\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\treturn nil\n}\n\nfunc (d *Driver) StartTask(cfg *drivers.TaskConfig) (*drivers.TaskHandle, *drivers.DriverNetwork, error) {\n\tif _, ok := d.tasks.Get(cfg.ID); ok {\n\t\treturn nil, nil, fmt.Errorf(\"taskConfig with ID '%s' already started\", cfg.ID)\n\t}\n\n\tvar driverConfig TaskConfig\n\n\tif err := cfg.DecodeDriverConfig(&driverConfig); err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"failed to decode driver config: %v\", err)\n\t}\n","sourceCodeStart":430,"sourceCodeEnd":466,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/drivers/qemu/driver.go#L430-L466","documentation":"validateArgs enforces the plugin-level args_allowlist: every QEMU command-line argument passed via the task config that starts with '-' (after trimming whitespace) must be an exact key in the allowlist map built from pluginConfigAllowList. Nomad throws this to prevent tasks from injecting arbitrary QEMU flags (e.g. -drive with host paths, -netdev, monitor sockets) that could compromise the host.","triggerScenarios":"StartTask (or TestArgsAllowList in tests) when the task config's 'args' array contains a flag beginning with '-' that is not exactly present in the driver plugin's args_allowlist configuration; note the exact-match check (map lookup, no wildcard/prefix matching of values).","commonSituations":"Adding a new QEMU flag to a job (e.g. -cpu host) without updating args_allowlist; the flag has a value like '-m 1024' and the allowlist only contains '-m' but the task passes the flag and value as one string; whitespace/typo differences make TrimSpace mismatch.","solutions":["Add the offending flag (the exact string including '-') to args_allowlist in the client's plugin configuration and restart the Nomad client.","Remove or reword the argument in the job's config args so it matches an already-allowed flag exactly (case- and whitespace-exact).","Ask the cluster operator to widen the allowlist if the flag is legitimately required."],"exampleFix":"// client.hcl (before)\nplugin \"qemu\" { config { args_allowlist = [\"-m\", \"-smp\"] } }\n// after\nplugin \"qemu\" { config { args_allowlist = [\"-m\", \"-smp\", \"-cpu\"] } }","handlingStrategy":"validation","validationCode":"allowlist := map[string]struct{}{\"-m\": {}, \"-smp\": {}, \"-cpu\": {}}\nfor _, a := range cfg.Args {\n    if strings.HasPrefix(strings.TrimSpace(a), \"-\") {\n        if _, ok := allowlist[a]; !ok {\n            return fmt.Errorf(\"arg %q must be added to args_allowlist\", a)\n        }\n    }\n}","typeGuard":"func argsInAllowlist(args []string, allowlist []string) bool {\n    set := make(map[string]struct{}, len(allowlist))\n    for _, a := range allowlist { set[a] = struct{}{} }\n    for _, a := range args {\n        if strings.HasPrefix(strings.TrimSpace(a), \"-\") {\n            if _, ok := set[a]; !ok { return false }\n        }\n    }\n    return true\n}","tryCatchPattern":"_, _, err := d.StartTask(cfg)\nif err != nil && strings.Contains(err.Error(), \"is not in args_allowlist\") {\n    // extract flagged arg from error and update client plugin config\n}","preventionTips":["Treat args_allowlist as code: version-control the client.hcl and update it with job changes","Keep each QEMU flag as a separate args element so exact match works","Audit new QEMU flags for security impact before allowlisting","Test job args against the allowlist in CI before deploy"],"tags":["qemu","nomad","security","args-allowlist"],"backgroundTag":"argument-not-in-allowlist","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}