It is now possible to explicitly allow/deny users of WATO to add or modify executables. This done with the new permission Can add or modify executables. By default only users with the role Administrator have this permission.
There are different places in Check_MK where an admin, the user of the configuration GUI, can use the GUI to add executable code to Check_MK.
For example when configuring datasource programs, the user inserts a command line for gathering monitoring data. This command line is then executed during monitoring by Check_MK.
Another example is the upload of extension packages (MKPs).
These functions have in common that the user provides data that is executed by Check_MK later in the context of Check_MK.
If you want to ensure that your WATO users can not "inject" arbitrary executables into your Check_MK installation, you only need to revoke this permission.
This permission is needed in addition to the other component related permissions. For example you need the wato.rulesets permission together with the new permission to be able to configure rulesets where bare command lines are configured.
These things are protected by the new permission at the moment: