# Possible to restrict CLI command to specific directory
**URL:** https://dmap-community.ductus.global/t/possible-to-restrict-cli-command-to-specific-directory/2771
**Category:** Other Northbound Interfaces
**Created:** [November 13, 2019, 9:02am UTC](https://dmap-community.ductus.global/t/possible-to-restrict-cli-command-to-specific-directory/2771 "2019-11-13T09:02:51Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@zodac](https://dmap-community.ductus.global/u/zodac)
#### Post date: [November 13, 2019, 9:02am UTC](https://dmap-community.ductus.global/t/possible-to-restrict-cli-command-to-specific-directory/2771/1 "2019-11-13T09:02:52Z")
Is there some option that can be added to a CLI modification that would allow me to restrict a command to only work in a specific directory (and sub-directories).
For example, I’d like to execute ‘file list/show’, but only in one directory, rather than exposing the whole filesystem.
Also, if using ‘load/save’, I’d like to retrieve files from a single directory, to make things a bit easier and avoid users from needing to know precisely where the files are stored, and instead knowing the filename would be sufficient.
I see the **/confdConfig/cli/restrictedFileRegexp** configuration option, but wasn’t able to get the regex working. I’m also wondering if the regex could be applied to specific commands, rather than the CLI as a whole.
Thanks!
---
### Author:  [@cohult](https://dmap-community.ductus.global/u/cohult)
#### Post date: [November 17, 2019, 8:48pm UTC](https://dmap-community.ductus.global/t/possible-to-restrict-cli-command-to-specific-directory/2771/2 "2019-11-17T20:48:15Z")
> [@zodac](#):
>
> **/confdConfig/cli/restrictedFileRegexp**
If you don’t want to use PAM to authenticate and restrict file access, try `/confdConfig/cli/restrictedFileAccess`. If this is set to ‘true’, then the user only has access to the home directory (or the directory where confd\_cli is started), or if a directory is specified in a cli command parameter (params/param/type/directory{wd} or params/param/type/file{wd}) to that directory.
---
### Author:  [@zodac](https://dmap-community.ductus.global/u/zodac)
#### Post date: [November 26, 2019, 12:07pm UTC](https://dmap-community.ductus.global/t/possible-to-restrict-cli-command-to-specific-directory/2771/3 "2019-11-26T12:07:03Z")
Hi @cohult,
Apologies for the delay.
> if a directory is specified in a cli command parameter (params/param/type/directory{wd} or params/param/type/file{wd})
I saw this in the user guide too. But I don’t see _params/param_ as one of the available options in the **/clispec/$MODE/modifications** tree, so I’m now sure how I would specify the working directory for a built-in command? I can do it with a custom command just fine.
---
### Author:  [@cohult](https://dmap-community.ductus.global/u/cohult)
#### Post date: [November 26, 2019, 4:31pm UTC](https://dmap-community.ductus.global/t/possible-to-restrict-cli-command-to-specific-directory/2771/4 "2019-11-26T16:31:53Z")
Override the built-in command with your own custom one instead of modifying it.
---
### Author:  [@zodac](https://dmap-community.ductus.global/u/zodac)
#### Post date: [November 27, 2019, 9:05am UTC](https://dmap-community.ductus.global/t/possible-to-restrict-cli-command-to-specific-directory/2771/5 "2019-11-27T09:05:24Z")
> Override the built-in command with your own custom one instead of modifying it.
Yeah, it was looking like that. Was hoping there was a simpler option.
Thanks for the info. 🙂
---
### Author:  [@cohult](https://dmap-community.ductus.global/u/cohult)
#### Post date: [November 27, 2019, 1:54pm UTC](https://dmap-community.ductus.global/t/possible-to-restrict-cli-command-to-specific-directory/2771/6 "2019-11-27T13:54:24Z")
Note that for example a script that replace the overridden command can just pass on the parameters to maapi (see for example the maapi tool). This way the authorization is checked before using that functionality.