SCAIRE
Command Capabilities
This page lists every command the agents may run on the Proxmox host and how each is classified (permission tier, blocked or safe flags). The table is what the security layers enforce, so you can audit what the agents are allowed to do.
Every classification comes from an authoritative source: man page, local binary, or
package metadata. ReadGuard checks the tier column to decide if an agent may run a
command; CommandValidator checks the flags to reject unsafe syntax.
| Description | Flags | Sudoers Path | Alternative | |||
|---|---|---|---|---|---|---|
| adduser | never allowed | all | Interactive user/group creation | /usr/sbin/adduser | Use: getent passwd or id for user info | |
| arch | allowed | all | Print machine architecture | /usr/bin/arch | - | |
| arcstat | allowed | all | ZFS ARC statistics (read-only) | /usr/sbin/arcstat | - | |
| arc_summary | allowed | all | ZFS ARC summary (read-only) | /usr/sbin/arc_summary | - | |
| arp | allowed | all | ARP cache (read-only; -d/-s/-f blocked) |
blocked: /(?:^|\s)-[a-z]*d(?:\s|$)/i, /(?:^|\s)-[a-z]*s(?:\s|$)/i, /(?:^|\s)-f\b/i
|
/usr/sbin/arp | Use: arp -a, arp -n, ip neigh show |
| at | never allowed | all | Schedule one-time command | /usr/bin/at | Use: systemctl list-timers for scheduled tasks | |
| atop | allowed | all | System monitor (interactive; -r replay is read-only) |
safe: /(^|\s)-r\b/
interactive
|
/usr/bin/atop | Use: atop -r /var/log/atop/atop_DATE -P PRC |
| awk | allowed | all | Text processing language (read-only) |
pipe filter
|
/usr/bin/awk | - |
| base32 | allowed | all | Base32 encode/decode |
pipe filter
|
/usr/bin/base32 | - |
| base64 | allowed | all | Base64 encode/decode |
pipe filter
|
/usr/bin/base64 | - |
| basename | allowed | all | Strip path/suffix from filename | /usr/bin/basename | - | |
| batch | never allowed | all | Schedule batch command | /usr/bin/batch | Use: systemctl list-timers for scheduled tasks | |
| bc | allowed | all | Arbitrary precision calculator |
pipe filter
|
/usr/bin/bc | - |
| blkdiscard | never allowed | all | Discard device sectors (destroys data) | /usr/sbin/blkdiscard | Use: lsblk or blkid for read-only device info | |
| blkid | allowed | all | Block device UUID/label/type | /usr/sbin/blkid | - | |
| blockdev | allowed | all | Block device ioctls (read-only; write commands blocked) |
blocked: /--setrw\b/i, /--setro\b/i, /--flushbufs\b/i, /--rereadpt\b/i, /--setra\b/i
|
/usr/sbin/blockdev | Use: blockdev --report, blockdev --getsize64 /dev/sda |
| brctl | never allowed | all | Deprecated bridge tool | /usr/sbin/brctl | Use: ip link show type bridge or bridge link | |
| bridge | allowed | all | Bridge devices (read-only; write actions blocked) |
blocked: /(?:^|\s)-batch\b/, /\s(?:add|del|delete|set|change|replace|append)(?:\s|$)/i
follow: /(?:^|\s)monitor\b/i
|
/usr/sbin/bridge | Use: bridge link show, bridge fdb show, bridge vlan show |
| bzip2 | never allowed | all | Compress files (modifies filesystem) | /usr/bin/bzip2 | Use: bzcat file.bz2 to read compressed files | |
| cat | allowed | all | File reader | /usr/bin/cat | - | |
| cfdisk | allowed | all | Interactive partition editor |
interactive
|
- | - |
| chcon | never allowed | all | Change SELinux context | /usr/bin/chcon | Use: ls -Z for SELinux contexts | |
| chfn | never allowed | all | Change user info (GECOS field) | /usr/bin/chfn | Use: getent passwd for user GECOS info | |
| chgrp | never allowed | all | Change group ownership | /usr/bin/chgrp | Use: ls -l or stat for group ownership | |
| chmod | never allowed | all | Change file permissions | /usr/bin/chmod | Use: ls -l or stat to view permissions | |
| chown | never allowed | all | Change file ownership | /usr/bin/chown | Use: ls -l or stat to view ownership | |
| chsh | never allowed | all | Change login shell | /usr/bin/chsh | Use: getent passwd to check user shells | |
| cksum | allowed | all | CRC checksum and byte count |
pipe filter
|
/usr/bin/cksum | - |
| column | allowed | all | Columnate text output |
pipe filter
|
/usr/bin/column | - |
| comm | allowed | all | Compare sorted files |
pipe filter
|
/usr/bin/comm | - |
| conntrack | allowed | all | Connection tracking (read via -L; delete/flush blocked, -E events hang) |
blocked: /(?:^|\s)-D\b/, /(?:^|\s)-F\b/, /(?:^|\s)-I\b/
follow: /(?:^|\s)-E\b/
|
/usr/sbin/conntrack | Use: conntrack -L, conntrack -S |
| cp | never allowed | all | Copy files (read-only agents cannot modify filesystem) | /usr/bin/cp | Use: cat, head, or less to read files | |
| crontab | never allowed | all | Edit crontab (schedules commands) | /usr/bin/crontab | Use: ls /etc/cron.* or systemctl status cron for schedule info | |
| curl | allowed | all | HTTP client (read-only; -T upload blocked) |
blocked: /(?:^|\s)-T\b/, /--upload-file\b/
|
/usr/bin/curl | Use: curl -s http://host/path, curl -I http://host/ |
| cut | allowed | all | Extract fields/columns |
pipe filter
|
/usr/bin/cut | - |
| date | allowed | all | Date/time display (read-only; -s/--set blocked) |
blocked: /(?:^|\s)-s\b/, /--set\b/
|
/usr/bin/date | Use: date, date +%Y-%m-%d, date -d yesterday |
| dd | never allowed | all | Copy/block-level data writer - can overwrite disks | /usr/bin/dd | Use: cat, cp, or rsync for safe file operations | |
| deluser | never allowed | all | Delete user/group | /usr/sbin/deluser | Use: getent passwd or id for user info | |
| df | allowed | all | Filesystem space usage | /usr/bin/df | - | |
| diff | allowed | all | File comparison | /usr/bin/diff | - | |
| dig | allowed | all | DNS lookup | /usr/bin/dig | - | |
| dirname | allowed | all | Directory path from filepath | /usr/bin/dirname | - | |
| dmesg | allowed | all | Kernel ring buffer (read-only; -w blocked) |
follow: /(?:^|\s)--?(?:w|follow)\b/i
|
/usr/bin/dmesg | Use: dmesg | tail -50 |
| dmidecode | allowed | all | Hardware inventory (SMBIOS/DMI) | /usr/sbin/dmidecode | - | |
| dmsetup | subcommand | all | Device mapper (read via info/ls/status; write subcommands blocked) |
write: create, remove, remove_all, suspend, resume, reload, rename, wipe_table, message, mknodes
|
/usr/sbin/dmsetup | Use: dmsetup info, dmsetup ls, dmsetup status |
| du | allowed | all | Directory space usage | /usr/bin/du | - | |
| echo | allowed | all | Text output (pipe usage) | /usr/bin/echo | - | |
| egrep | allowed | all | Extended regex search (grep -E) |
pipe filter
|
/usr/bin/egrep | - |
| emacs | allowed | all | Interactive editor |
interactive
|
- | - |
| env | allowed | all | Print/set environment | /usr/bin/env | - | |
| ethtool | allowed | all | Network interface diagnostics (read-only; -s change blocked) |
blocked: /(?:^|\s)-s\b/
|
/usr/sbin/ethtool | Use: ethtool eth0, ethtool -i eth0, ethtool -S eth0 |
| expand | allowed | all | Convert tabs to spaces |
pipe filter
|
/usr/bin/expand | - |
| expr | allowed | all | Evaluate expressions | /usr/bin/expr | - | |
| factor | allowed | all | Prime factorization |
pipe filter
|
/usr/bin/factor | - |
| fdisk | allowed | all | Partition table editor (interactive; -l is read-only list) |
safe: /(^|\s)-l(\s|$)/
interactive
|
/usr/sbin/fdisk | Use fdisk -l, lsblk, or blkid for read-only partition info |
| fgrep | allowed | all | Fixed-string search (grep -F) |
pipe filter
|
/usr/bin/fgrep | - |
| file | allowed | all | File type identification | /usr/bin/file | - | |
| find | allowed | all | File search (read-only; -delete/-exec blocked) |
blocked: /(?:^|\s)-(?:delete|exec|execdir)\b/i
|
/usr/bin/find | find without -delete/-exec is read-only |
| findmnt | allowed | all | Mounted filesystem listing | /usr/bin/findmnt | - | |
| fmt | allowed | all | Format text paragraphs |
pipe filter
|
/usr/bin/fmt | - |
| fold | allowed | all | Wrap lines to width |
pipe filter
|
/usr/bin/fold | - |
| free | allowed | all | Memory usage summary | /usr/bin/free | - | |
| fuser | allowed | all | Process/file association (read-only; -k kill blocked) |
blocked: /(?:^|\s)-[a-z]*k[a-z]*/i, /--kill\b/i
|
/usr/bin/fuser | Use: fuser -v /path to list processes |
| grep | allowed | all | Text search (read-only) |
pipe filter
|
/usr/bin/grep | - |
| groupadd | never allowed | all | Create group | /usr/sbin/groupadd | Use: getent group for group info | |
| groupdel | never allowed | all | Delete group | /usr/sbin/groupdel | Use: getent group for group info | |
| groupmod | never allowed | all | Modify group | /usr/sbin/groupmod | Use: getent group for group info | |
| groups | allowed | all | User group membership | /usr/bin/groups | - | |
| gunzip | never allowed | all | Decompress .gz files (modifies filesystem) | /usr/bin/gunzip | Use: zcat file.gz to read compressed files | |
| gzip | never allowed | all | Compress files (modifies filesystem) | /usr/bin/gzip | Use: zcat file.gz to read compressed files | |
| ha-manager | subcommand | all | Proxmox HA manager (read via status/config) |
write: add, remove, migrate, relocate, set
|
/usr/sbin/ha-manager | Use: ha-manager status, ha-manager config |
| halt | never allowed | all | System halt | /usr/sbin/halt | Host power operations require Proxmox web UI or physical access | |
| hdparm | never allowed | all | Disk parameter manipulation | /usr/sbin/hdparm | Use: smartctl -H for disk health or lsblk for disk listing | |
| head | allowed | all | Output first lines |
pipe filter
|
/usr/bin/head | - |
| host | allowed | all | DNS resolver lookup | /usr/bin/host | - | |
| hostid | allowed | all | Print host ID | /usr/bin/hostid | - | |
| hostname | allowed | all | Hostname display (read-only; -F/--file blocked) |
blocked: /(?:^|\s)-F\b/, /--file\b/
|
/usr/bin/hostname | Use: hostname, hostname -f, hostname -I |
| hostnamectl | subcommand | all | System identity info (read via status; set-hostname blocked) |
write: set-hostname
|
/usr/bin/hostnamectl | Use: hostnamectl, hostnamectl status |
| htop | allowed | all | Interactive process viewer |
interactive
|
- | - |
| id | allowed | all | User/group IDs | /usr/bin/id | - | |
| iftop | allowed | all | Bandwidth monitor (interactive; -t text mode is read-only) |
safe: /(?:^|\s)-t\b/, /(?:^|\s)-s\s+\d/i
interactive
|
/usr/sbin/iftop | Use: iftop -t -s 10 -n |
| install | never allowed | all | Copy files and set attributes | /usr/bin/install | Use: dpkg -L or which to locate installed files | |
| iostat | allowed | all | I/O and CPU statistics | /usr/bin/iostat | - | |
| iotop | allowed | all | I/O monitoring | /usr/bin/iotop | - | |
| ip | allowed | all | Network interface/routing (read-only; write actions + -batch blocked) |
blocked: /(?:^|\s)-batch\b/, /\s(?:add|del|delete|set|change|replace|flush)(?:\s|$)/i
follow: /(?:^|\s)monitor\b/i
|
/usr/sbin/ip | Use: ip addr show, ip route show, ip -s link |
| ip6tables | allowed | all | IPv6 firewall (read-only; write flags blocked) |
blocked: /(?:^|\s)-(?:A|D|I|R|F|N|X|E|P|Z)(?:\s|=|$)/, /(?:^|\s)--(?:append|delete|insert|replace|flush|new-chain|delete-chain|rename-chain|policy|zero)\b/i
|
/usr/sbin/ip6tables | Use: ip6tables -L, ip6tables -S |
| iperf3 | allowed | all | Network throughput test (client mode; -s server hangs) |
follow: /(?:^|\s)-s\b/, /--server\b/
|
/usr/bin/iperf3 | Use: iperf3 -c hostname |
| iptables | allowed | all | IPv4 firewall (read-only; write flags blocked) |
blocked: /(?:^|\s)-(?:A|D|I|R|F|N|X|E|P|Z)(?:\s|=|$)/, /(?:^|\s)--(?:append|delete|insert|replace|flush|new-chain|delete-chain|rename-chain|policy|zero)\b/i
|
/usr/sbin/iptables | Use: iptables -L -n, iptables -S, iptables -t nat -L |
| join | allowed | all | Join lines on common field |
pipe filter
|
/usr/bin/join | - |
| journalctl | allowed | all | Query systemd journal (read-only; -f blocked) |
follow: /(?:^|\s)-[a-z]*f[a-z]*|--follow/i
|
/usr/bin/journalctl | Use: journalctl -u service --no-pager |
| jq | allowed | all | JSON processor | /usr/bin/jq | - | |
| kill | limited write | all | Send signal to process | /usr/bin/kill | Use: ps aux or pgrep to inspect; ask Faire (limited_write) to kill | |
| killall | limited write | all | Kill processes by name | /usr/bin/killall | - | |
| last | allowed | all | Login history | /usr/bin/last | - | |
| lastlog | allowed | all | Last login per user | /usr/bin/lastlog | - | |
| less | allowed | all | Interactive pager |
interactive
|
- | - |
| link | never allowed | all | Create hard link | /usr/bin/link | Use: ls -li or stat to inspect inodes and hard links | |
| ln | never allowed | all | Create hard/symlink | /usr/bin/ln | Use: readlink to inspect symlinks | |
| login | allowed | all | Login shell |
interactive
|
- | - |
| loginctl | allowed | all | systemd login sessions | /usr/bin/loginctl | - | |
| logname | allowed | all | Print login name | /usr/bin/logname | - | |
| losetup | never allowed | all | Configure loop device | /usr/sbin/losetup | Use: lsblk or cat /proc/partitions for block device info | |
| ls | allowed | all | Directory listing | /usr/bin/ls | - | |
| lsblk | allowed | all | Block device listing | /usr/bin/lsblk | - | |
| lscpu | allowed | all | CPU architecture info | /usr/bin/lscpu | - | |
| lshw | allowed | all | Hardware listing | /usr/sbin/lshw | - | |
| lslocks | allowed | all | System file locks | /usr/bin/lslocks | - | |
| lsmod | allowed | all | Loaded kernel modules | /usr/bin/lsmod | - | |
| lsof | allowed | all | Open files/sockets | /usr/bin/lsof | - | |
| lspci | allowed | all | PCI device listing | /usr/bin/lspci | - | |
| lsusb | allowed | all | USB device listing | /usr/bin/lsusb | - | |
| lvs | allowed | all | LVM logical volumes | /usr/sbin/lvs | - | |
| man | allowed | all | Manual page viewer |
interactive
|
- | - |
| md5sum | allowed | all | MD5 checksum |
pipe filter
|
/usr/bin/md5sum | - |
| mkdir | never allowed | all | Create directory | /usr/bin/mkdir | Read-only agents cannot create filesystem objects | |
| mkfifo | never allowed | all | Create named pipe | /usr/bin/mkfifo | Use: ls -l to check for named pipes (type p) | |
| mkfs | never allowed | all | Create filesystem (destroys existing data) | /usr/sbin/mkfs | Use: lsblk, blkid, or df -h for read-only storage info | |
| mknod | never allowed | all | Create special file (device node) | /usr/bin/mknod | Use: ls -l /dev to inspect device nodes | |
| more | allowed | all | Interactive pager |
interactive
|
- | - |
| mount | never allowed | all | Mount filesystem (use findmnt for read-only info) | /usr/bin/mount | Use: findmnt or mount -l (read-only listing) | |
| mpstat | allowed | all | Per-CPU statistics | /usr/bin/mpstat | - | |
| mtr | allowed | all | Network tracer (interactive; -r report mode is read-only) |
safe: /(?:^|\s)-[a-z]*r[a-z]*/i, /--report\b/i
interactive
|
/usr/bin/mtr | Use: mtr -r -c 10 host |
| mv | never allowed | all | Move/rename files | /usr/bin/mv | Use: ls and find to locate files | |
| nano | allowed | all | Interactive editor |
interactive
|
- | - |
| ncdu | allowed | all | Disk usage analyzer (interactive; -0 export mode is read-only) |
safe: /(?:^|\s)-0\b/
interactive
|
/usr/bin/ncdu | Use: ncdu -0 -o - /path (export to stdout) |
| nethogs | allowed | all | Per-process network usage (interactive; -t text mode is read-only) |
safe: /(?:^|\s)-t\b/
interactive
|
/usr/sbin/nethogs | Use: nethogs -t eth0 |
| netstat | allowed | all | Network connections/sockets | /bin/netstat | - | |
| newgrp | never allowed | all | Switch to new group | /usr/bin/newgrp | Use: id or groups for group membership | |
| nft | subcommand | all | nftables firewall (read via list; write subcommands blocked) |
blocked: /(?:^|\s)-f\b/, /(?:^|\s)--file\b/, /(?:^|\s)-i\b/, /(?:^|\s)--interactive\b/
write: add, delete, insert, replace, flush, create, destroy, rename, load
|
/usr/sbin/nft | Use: nft list ruleset, nft list tables |
| nice | limited write | all | Run with modified priority | /usr/bin/nice | - | |
| nl | allowed | all | Number lines |
pipe filter
|
/usr/bin/nl | - |
| nmap | allowed | all | Network scanner (read-only; --script blocked) |
blocked: /--script\b/i
|
/usr/bin/nmap | Use: nmap -sT host, nmap -sn network/24 |
| nproc | allowed | all | CPU count | /usr/bin/nproc | - | |
| nslookup | allowed | all | DNS lookup utility | /usr/bin/nslookup | - | |
| nstat | allowed | all | SNMP network statistics | /usr/bin/nstat | - | |
| numactl | allowed | all | NUMA policy display | /usr/bin/numactl | - | |
| nvidia-smi | allowed | all | NVIDIA GPU status (read-only; config changes + loop blocked) |
blocked: /(?:^|\s)-[a-z]*e[a-z]*=/i, /--ecc-config\b/i, /(?:^|\s)-[a-z]*p[a-z]*=/i, /--reset-ecc/i, /(?:^|\s)-[a-z]*c[a-z]*=/i, /--compute-mode\b/i, /--persistence-mode\b/i, /(?:^|\s)-pm\b/, /(?:^|\s)-ac\b/
follow: /(?:^|\s)-[a-z]*l\b/, /--loop\b/i
|
/usr/bin/nvidia-smi | Use: nvidia-smi, nvidia-smi -q, nvidia-smi --query-gpu=temperature.gpu --format=csv |
| od | allowed | all | Octal/hex dump | /usr/bin/od | - | |
| openssl | allowed | all | TLS/crypto toolkit (diagnostic use: x509, s_client, verify) | /usr/bin/openssl | - | |
| parted | never allowed | all | Partition editor (use lsblk/fdisk -l for read info) | /usr/sbin/parted | Use: lsblk, fdisk -l, or sfdisk -l for read-only partition info | |
| passwd | allowed | all | Password change |
interactive
|
- | - |
| paste | allowed | all | Merge lines from multiple files |
pipe filter
|
/usr/bin/paste | - |
| pct | subcommand | all | Proxmox container (LXC) management |
write: start, stop, restart, reboot, shutdown, suspend, resume, unlock, create, destroy, set, push, restore
recovery: start, stop, restart, reboot, shutdown, resume
|
/usr/sbin/pct | - |
| pgrep | allowed | all | Find processes by name/pattern | /usr/bin/pgrep | - | |
| pico | allowed | all | Interactive editor |
interactive
|
- | - |
| pidstat | allowed | all | Per-task statistics | /usr/bin/pidstat | - | |
| ping | allowed | all | Network connectivity test | /usr/bin/ping | - | |
| pinky | allowed | all | Lightweight user info | /usr/bin/pinky | - | |
| pkill | limited write | all | Kill processes by pattern | /usr/bin/pkill | - | |
| pmap | allowed | all | Process memory map | /usr/bin/pmap | - | |
| poweroff | never allowed | all | System power off | /usr/sbin/poweroff | Host power operations require Proxmox web UI or physical access | |
| pr | allowed | all | Paginate text for printing |
pipe filter
|
/usr/bin/pr | - |
| printenv | allowed | all | Print environment variables | /usr/bin/printenv | - | |
| printf | allowed | all | Format and print data | /usr/bin/printf | - | |
| proxmox-backup-client | subcommand | all | Proxmox backup client (read via list/snapshots/status) |
write: backup, restore, upload, prune, forget, pull
|
/usr/bin/proxmox-backup-client | Use: proxmox-backup-client snapshots <repo> |
| proxmox-boot-tool | subcommand | all | Proxmox boot tool (read via status) |
write: format, init, refresh, set-kernels, clean
|
/usr/sbin/proxmox-boot-tool | Use: proxmox-boot-tool status |
| ps | allowed | all | Process snapshot | /usr/bin/ps | - | |
| pstree | allowed | all | Process tree display | /usr/bin/pstree | - | |
| pve-firewall | subcommand | all | Proxmox firewall (read via status) |
write: start, stop, clear, compile
|
/usr/sbin/pve-firewall | Use: pve-firewall status |
| pveam | subcommand | all | Proxmox appliance/template manager (read via list/available) |
write: download, remove, update
|
/usr/bin/pveam | Use: pveam list, pveam available |
| pveceph | never allowed | all | Proxmox Ceph management | /usr/bin/pveceph | Use: ceph status for Ceph health (if installed) | |
| pvecm | subcommand | all | Proxmox cluster manager (read via status/nodes) |
write: add, delnode, create, updatecerts, expected, addnode
|
/usr/bin/pvecm | Use: pvecm status, pvecm nodes |
| pvenode | subcommand | all | Proxmox node management (read via tasks/apiscan/info) |
write: startall, stopall, migrate, wakeonlan, cert, acme
|
/usr/bin/pvenode | Use: pvenode tasks, pvenode apiscan |
| pveperf | allowed | all | Proxmox performance benchmark | /usr/bin/pveperf | - | |
| pvereport | allowed | all | Proxmox system report generator | /usr/bin/pvereport | - | |
| pvesh | subcommand | all | Proxmox API shell (read via get/ls/path) |
write: create, set, delete, put, post
|
/usr/bin/pvesh | Use: pvesh get /nodes, pvesh ls / |
| pvesm | subcommand | all | Proxmox storage manager |
write: add, alloc, free, create, remove, set
|
/usr/sbin/pvesm | Use: pvesm status, pvesm list for read-only storage info |
| pvesr | subcommand | all | Proxmox storage replication (read via list) |
write: create, delete, disable, enable
|
/usr/bin/pvesr | Use: pvesr list |
| pveum | never allowed | all | Proxmox user management | /usr/bin/pveum | Use: pvesh get /access for read-only user/role info | |
| pveupdate | never allowed | all | Proxmox package update (runs apt-get) | /usr/bin/pveupdate | Use: pveversion for version info or apt list --upgradable | |
| pveversion | allowed | all | Proxmox VE version info | /usr/bin/pveversion | - | |
| pwd | allowed | all | Print working directory | /usr/bin/pwd | - | |
| qm | subcommand | all | Proxmox VM (KVM) management |
write: start, stop, restart, reboot, shutdown, suspend, resume, unlock, create, destroy, set, clone, snapshot
recovery: start, stop, restart, reboot, shutdown, resume
|
/usr/sbin/qm | - |
| qmrestore | never allowed | all | Restore VM from backup | /usr/sbin/qmrestore | Use: qm config <vmid> to inspect VM config | |
| readlink | allowed | all | Symlink target | /usr/bin/readlink | - | |
| realpath | allowed | all | Resolve absolute path | /usr/bin/realpath | - | |
| reboot | never allowed | all | System reboot | /usr/sbin/reboot | Host power operations require Proxmox web UI or physical access | |
| renice | limited write | all | Change process priority | /usr/bin/renice | - | |
| rev | allowed | all | Reverse lines |
pipe filter
|
/usr/bin/rev | - |
| rgrep | allowed | all | Recursive grep |
pipe filter
|
/usr/bin/rgrep | - |
| rm | never allowed | all | Remove files | /usr/bin/rm | Use: find or ls to inspect files | |
| rmdir | never allowed | all | Remove directory | /usr/bin/rmdir | Use: ls -la to inspect directories | |
| route | allowed | all | Routing table display (read-only; add/del blocked) |
blocked: /(?:^|\s)(?:add|del)(?:\s|$)/i
|
/usr/sbin/route | Use: route -n, ip route show |
| rsync | allowed | all | File sync tool (--remove-source-files blocked) |
blocked: /--remove-source-files\b/i
|
/usr/bin/rsync | Use: rsync -avn src/ dest/ (dry-run preview) |
| runcon | never allowed | all | Run with SELinux context | /usr/bin/runcon | Use: ls -Z or ps -eZ for security contexts | |
| sar | allowed | all | System activity reporter | /usr/bin/sar | - | |
| schedtool | limited write | all | Query/set CPU scheduling policy | /usr/bin/schedtool | - | |
| screen | allowed | all | Terminal multiplexer |
interactive
|
- | - |
| sed | allowed | all | Stream editor (read-only mode; -i blocked) |
blocked: /(?:^|\s)-[a-z]*i[a-z]*/i
pipe filter
|
/usr/bin/sed | Use: sed 's/a/b/' (stream mode, no -i) |
| sensors | allowed | all | Hardware sensors (read-only; -s set-limits blocked) |
blocked: /(?:^|\s)-s\b/
|
/usr/bin/sensors | Use: sensors, sensors -u |
| seq | allowed | all | Number sequence generator | /usr/bin/seq | - | |
| sfdisk | allowed | all | Partition table (interactive; -l/-d/-s are read-only) |
safe: /(?:^|\s)-[a-z]*l(?:\s|$)/i, /(?:^|\s)-d\b/, /(?:^|\s)-s\b/
interactive
|
/usr/sbin/sfdisk | Use: sfdisk -l, sfdisk -d /dev/sda, lsblk |
| sha1sum | allowed | all | SHA-1 checksum |
pipe filter
|
/usr/bin/sha1sum | - |
| sha256sum | allowed | all | SHA-256 checksum |
pipe filter
|
/usr/bin/sha256sum | - |
| shell | allowed | all | Login shell |
interactive
|
- | - |
| shred | never allowed | all | Securely overwrite file | /usr/bin/shred | Use: file or ls to inspect files | |
| shutdown | never allowed | all | System shutdown | /usr/sbin/shutdown | Host power operations require Proxmox web UI or physical access | |
| skopeo | subcommand | all | Container image inspection (read via inspect/list-tags) |
write: copy, delete, sync
|
/usr/bin/skopeo | Use: skopeo inspect docker://image:tag |
| slabtop | allowed | all | Kernel slab cache stats | /usr/bin/slabtop | - | |
| sleep | allowed | all | Delay for N seconds | /usr/bin/sleep | - | |
| smartctl | allowed | all | SMART disk health monitoring | /usr/sbin/smartctl | - | |
| sort | allowed | all | Sort lines |
pipe filter
|
/usr/bin/sort | - |
| ss | allowed | all | Socket statistics | /usr/bin/ss | - | |
| stat | allowed | all | File status/metadata | /usr/bin/stat | - | |
| strace | allowed | all | System call tracer (-p attach blocked for read-only) |
blocked: /(?:^|\s)-p\b/
|
/usr/bin/strace | Use: strace -c command (count mode, self-contained) |
| strings | allowed | all | Extract printable strings from binary | /usr/bin/strings | - | |
| su | allowed | all | Switch user |
interactive
|
- | - |
| sudo | allowed | all | Privilege escalation (CommandBuilder adds sudo -n) |
interactive
|
- | - |
| swapoff | never allowed | all | Disable swap device | /usr/sbin/swapoff | Use: free -m or cat /proc/swaps for swap status | |
| swapon | never allowed | all | Enable swap device | /usr/sbin/swapon | Use: free -m or cat /proc/swaps for swap status | |
| sysctl | allowed | all | Kernel parameters (read-only; -w/-p and var=value blocked) |
blocked: /(?:^|\s)-w\b/, /(?:^|\s)-p\b/, /--write\b/, /--load\b/, /\b[a-z_]+\.[a-z_.]+=/i
|
/usr/sbin/sysctl | Use: sysctl -a, sysctl kernel.hostname, sysctl net.ipv4.ip_forward |
| systemctl | subcommand | all | systemd service management |
write: start, stop, restart, reload, enable, disable, mask, unmask, daemon-reload, isolate, edit
recovery: restart, reload, start, stop
|
/usr/bin/systemctl | - |
| systemd-analyze | allowed | all | Boot/systemd analysis (read-only; set-log-level blocked) |
blocked: /(?:^|\s)set-log-level\b/i
|
/usr/bin/systemd-analyze | Use: systemd-analyze blame, systemd-analyze time |
| systemd-cgtop | allowed | all | cgroup resource monitor (interactive; -b batch is read-only) |
safe: /(?:^|\s)-[a-z]*b[a-z]*/i, /--batch\b/i
interactive
|
/usr/bin/systemd-cgtop | Use: systemd-cgtop -b -n 1 |
| tac | allowed | all | Reverse cat (last line first) |
pipe filter
|
/usr/bin/tac | - |
| tail | allowed | all | Output last lines (read-only; -f blocked) |
follow: /(?:^|\s)-[a-z]*f[a-z]*|--follow/i
pipe filter
|
/usr/bin/tail | Use: tail -n 50 file |
| tar | allowed | all | Archive utility (read-only via -t; create/extract blocked) |
blocked: /(?:^|\s)-[a-z]*x[a-z]*/i, /(?:^|\s)-[a-z]*c[a-z]*/i, /(?:^|\s)-[a-z]*r[a-z]*/i, /(?:^|\s)-[a-z]*u\b/i, /--extract\b/i, /--create\b/i
|
/usr/bin/tar | Use: tar -tf archive.tar (list contents) |
| tc | never allowed | all | Traffic control manipulation | /usr/sbin/tc | Use: ip -s link for traffic statistics | |
| tcpdump | allowed | all | Packet capture (read-only stdout; -w file write blocked) |
blocked: /(?:^|\s)-w\b/
|
/usr/sbin/tcpdump | Use: tcpdump -i eth0 -n port 80, tcpdump -c 10 |
| tee | allowed | all | Pipe T-junction (output duplication) | /usr/bin/tee | - | |
| test | allowed | all | File/expression test | /usr/bin/test | - | |
| timedatectl | allowed | all | systemd time/timezone info | /usr/bin/timedatectl | - | |
| timeout | allowed | all | Run command with time limit | /usr/bin/timeout | - | |
| tmux | allowed | all | Terminal multiplexer |
interactive
|
- | - |
| top | allowed | all | Process viewer (interactive; -b is batch/read-only) |
safe: /(^|\s)-b(\s|$)/
interactive
|
/usr/bin/top | Use: top -b -n 1 |
| touch | never allowed | all | Change file timestamps or create files | /usr/bin/touch | Use: stat to check timestamps | |
| tr | allowed | all | Character translation |
pipe filter
|
/usr/bin/tr | - |
| tracepath | allowed | all | Network path discovery | /usr/bin/tracepath | - | |
| traceroute | allowed | all | Network path tracing | /usr/bin/traceroute | - | |
| truncate | never allowed | all | Shrink or extend file | /usr/bin/truncate | Use: ls -lh or stat to check file sizes | |
| tshark | allowed | all | Wireshark CLI (read-only decode; -w file write blocked) |
blocked: /(?:^|\s)-w\b/
|
/usr/sbin/tshark | Use: tshark -i eth0 -c 50 |
| tty | allowed | all | Print terminal name | /usr/bin/tty | - | |
| umount | never allowed | all | Unmount filesystem (use findmnt for read-only info) | /usr/bin/umount | Use: findmnt or lsblk for filesystem info | |
| uname | allowed | all | System/kernel info | /usr/bin/uname | - | |
| unexpand | allowed | all | Convert spaces to tabs |
pipe filter
|
/usr/bin/unexpand | - |
| uniq | allowed | all | Filter adjacent matching lines |
pipe filter
|
/usr/bin/uniq | - |
| unlink | never allowed | all | Remove file | /usr/bin/unlink | Use: ls -l to inspect files | |
| uptime | allowed | all | System uptime and load | /usr/bin/uptime | - | |
| useradd | never allowed | all | Create user account | /usr/sbin/useradd | Use: getent passwd or id to view users | |
| userdel | never allowed | all | Delete user account | /usr/sbin/userdel | Use: getent passwd or id for user info | |
| usermod | never allowed | all | Modify user account | /usr/sbin/usermod | Use: getent passwd or id for user info | |
| users | allowed | all | Print logged-in user names | /usr/bin/users | - | |
| vgs | allowed | all | LVM volume groups | /usr/sbin/vgs | - | |
| vi | allowed | all | Interactive editor |
interactive
|
- | Use: cat, head, or sed for non-interactive file viewing/editing |
| vim | allowed | all | Interactive editor |
interactive
|
- | Use: cat, head, or sed for non-interactive file viewing/editing |
| visudo | allowed | all | Sudoers editor |
interactive
|
- | - |
| vmstat | allowed | all | Virtual memory statistics | /usr/bin/vmstat | - | |
| vzdump | never allowed | all | Proxmox backup creation | /usr/bin/vzdump | Use: pveversion or pvereport for system status | |
| w | allowed | all | Logged-in users and activity | /usr/bin/w | - | |
| watch | allowed | all | Runs a command repeatedly (hangs SSH) |
interactive
|
- | - |
| wc | allowed | all | Word/line count |
pipe filter
|
/usr/bin/wc | - |
| wget | allowed | all | HTTP/HTTPS file download | /usr/bin/wget | - | |
| whereis | allowed | all | Locate binary/source/man for command | /usr/bin/whereis | - | |
| which | allowed | all | Locate command in PATH | /usr/bin/which | - | |
| who | allowed | all | Logged-in users | /usr/bin/who | - | |
| whoami | allowed | all | Current user name | /usr/bin/whoami | - | |
| whois | allowed | all | WHOIS domain lookup | /usr/bin/whois | - | |
| wipefs | never allowed | all | Wipe device signatures (destroys partition tables) | /usr/sbin/wipefs | Use: lsblk or blkid for read-only device info | |
| xz | never allowed | all | Compress files (modifies filesystem) | /usr/bin/xz | Use: xzcat file.xz to read compressed files | |
| xzcat | allowed | all | Read xz-compressed files |
pipe filter
|
/usr/bin/xzcat | - |
| zcat | allowed | all | Read gzip-compressed files | /usr/bin/zcat | - | |
| zdb | allowed | all | ZFS pool internals debugger (read-only) | /usr/sbin/zdb | - | |
| zed | allowed | all | ZFS Event Daemon (background process) | /usr/sbin/zed | - | |
| zfs | subcommand | all | ZFS dataset and snapshot management |
write: create, destroy, snapshot, clone, rename, send, receive, set, inherit, upgrade, mount, unmount, share, unshare, promote, bookmark, load-key, unload-key, change-key, rollback, diff
|
/usr/sbin/zfs | Use: zfs list, zfs get for read-only dataset info |
| zpool | subcommand | all | ZFS pool management |
write: create, destroy, export, import, add, remove, attach, detach, replace, offline, online, clear, upgrade, checkpoint, initialize, trim, reguid, reopen, labelclear, scrub
confirm: scrub
|
/usr/sbin/zpool | Use: zpool status, zpool list, zpool iostat for read-only pool info |
| zstd | never allowed | all | Compress files (modifies filesystem) | /usr/bin/zstd | Use: zstdcat file.zst to read compressed files | |
| zstdcat | allowed | all | Read zstd-compressed files |
pipe filter
|
/usr/bin/zstdcat | - |