One interpreter, many script allowlists
Without launchers, every script shares the interpreter’s permissions. Launchers split that so an approved python3 cannot run an unapproved script.
Python should not inherit every script's rights
If python3 may use the network, every Python script inherits that. Secure Script Launchers give each script its own allowlist entry.
Overview: Without Secure Script Launchers, every Python, Perl, or PHP script would share the interpreter’s permissions — if python3 is allowed to access the network, every Python script can access the network. Secure Script Launchers solve this by giving each script its own allowlist entry, so you control exactly what each script can do. The Dashboard presents this when script interpreters are detected on the system.
In this section
- Each script gets its own allowlist — Why allowlisting the interpreter is not enough, and how Secure Script Launchers split permissions per script.
- Configuring Script Launchers — Direct use for testing and permanent symbolic link setups.
- Included Script Launchers — List of available launchers for Python, Perl, PHP, etc.
Secure Script Launchers is row 4 on the Lockdown Checklist. The Suggested Next Step stays on Launchers ([s]) while interpreters are pending. Skipping activation does not mark the row complete. Once launchers are activated, or the row is not applicable, the Suggested Next Step goes to File Access ([f]) if that queue still has items — see Allowlisting Basics.
Turn on per-script allowlisting
Activate Secure Script Launchers for Python, Perl, and PHP so each script is reviewed on its own, not as the interpreter.
Which script launchers ship in the box
Secure Script Launchers included with Root Lock. The Dashboard offers them when it finds the matching interpreter.
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.