Exec Policies

Execution modes, allowlist/denylist management, and inline eval controls

Exec Policies

Atlas agents can execute commands on behalf of peers. The exec security policy controls which commands are allowed and under what conditions.

Exec modes

The exec_security.mode setting controls the overall execution policy:

Mode	Behavior
deny	Default. All command execution is blocked.
allowlist	Only binaries on the allowlist can execute.
full	Any command can execute (subject to denylist filtering).

Exec must be explicitly enabled before any mode takes effect. By default, exec.enabled is false.

Enable exec

1. Enable the exec engine

   atlas config set exec.enabled true
   
2. Choose a security mode

   Allowlist mode (recommended)

   atlas config security set-mode allowlist
   

Managing the allowlist

In allowlist mode, only explicitly approved binaries can execute:

# Add a binary to the allowlist
atlas config security allow python3
atlas config security allow node

# View current policy
atlas config security show

Output:

Mode              : allowlist
Strict inline eval: true
Allowed binaries  : python3, node
Denied binaries   : rm, sudo, chmod

Managing the denylist

The denylist applies in all modes (including full mode). Denied binaries are always blocked:

# Add a binary to the denylist
atlas config security deny curl
atlas config security deny wget

Default denied binaries:

Binary	Reason
rm	File deletion
sudo	Privilege escalation
chmod	Permission modification

Strict inline eval

When strict_inline_eval is true (the default), the agent blocks inline code evaluation patterns such as shell expansion and pipe chains that could bypass the allowlist/denylist:

# View current setting
atlas config security show

# Toggle it
atlas config set exec_security.strict_inline_eval false

Disabling strict inline eval in production is not recommended. It allows peers to craft commands that bypass binary-level filtering.

Exec configuration reference

Full config.toml section:

[exec]
enabled = false                    # Must be true for any execution
default_timeout_secs = 300         # Default command timeout (5 min)
max_concurrent_sessions = 10       # Max parallel exec sessions
default_sandbox = "none"           # Sandbox: none, bubblewrap, docker
output_buffer_limit = 1048576      # Max output buffer (1 MB)

[exec_security]
mode = "deny"                      # deny | allowlist | full
allowed_binaries = []              # Binaries allowed in allowlist mode
denied_binaries = ["rm", "sudo", "chmod"]  # Always blocked
strict_inline_eval = true          # Block inline eval patterns
approval_required_patterns = []    # Patterns requiring approval

Reset to defaults

atlas config security reset

This resets exec_security to:

• Mode: deny
• Allowed binaries: empty
• Denied binaries: rm, sudo, chmod
• Strict inline eval: true
• Approval required patterns: empty

Running commands

Once exec is enabled and the security mode allows it:

Foreground execution

atlas exec run python3 script.py --timeout 60 --sandbox none

Flag	Default	Description
--timeout	300	Timeout in seconds
--sandbox	none	Sandbox mode: none, bubblewrap, docker
--approve	false	Require approval before execution
--host	local	Where to run: local, gateway, node:<peer_id>