By default, TeX is in restricted write18 mode, which means it can only call a select few external programs. How can I edit that list of programs? This would enable me to use packages that need to call other programs than those that are allowed by default without having to sacrifice all of the security of restricted write18.

I am looking for a solution both for MiKTeX and TeX Live.


For TeX Live, issue from the terminal

kpsewhich texmf.cnf

This should answer


(the year can vary). This is the top level texmf.cnf and values set here are not overridden by later loaded similar configuration files.

The main texmf.cnf file, which sits as /usr/local/texlive/2019/texmf-dist/web2c/texmf.cnf contains

shell_escape_commands = \

Check the list, because new versions of TeX Live might change the list.

Now append the list above to the top level texmf.cnf file (you need appropriate privileges to edit it) and add in the same way the programs you want to be available in the restricted shell. Carefully note the format: the trailing backslashes avoid adding spaces after commas.

But don't blame me if your system gets damaged by running dangerous programs in the restricted shell escape.

You can add one or more programs on the fly when calling pdflatex (or other engine) from the command line by something like (Bash syntax)

shell_escape_commands=$(kpsewhich -var-value=shell_escape_commands),ls pdflatex file

Here the added program is ls.

|improve this answer|||||
  • 2
    Just out of curiosity, is it possible to add to a variable, like shell_escape_commands = $shell_escape_commands,ls? Or do I need to repeat the entire list from the main texmf.cnf? – Phelype Oleinik Mar 17 at 22:56
  • 4
    @PhelypeOleinik No, because the main texmf.cnf file is read later than the top level one, so the value of shell_escape_commands has not yet been set. – egreg Mar 17 at 22:58
  • 1
    @PhelypeOleinik I added an alternative way that might interest you. – egreg Mar 17 at 23:03
  • That's handy :-) Thanks! – Phelype Oleinik Mar 17 at 23:05
  • Note that the exact file locations may be different. For me kpsewhich returns /etc/texmf/web2c/texmf.cnf (empty apart from setting VARTEXFONTS), while there are two other files /usr/share/texmf/web2c/texmf.cnf and /usr/share/texlive/texmf-dist/web2c/texmf.cnf that contain the shell escape settings (both files are exactly equal). Also, the top level file warns that it should not be edited because this may interfere with upgrades, and /etc/texmf/texmf.d should be edited instead (or alternatively an extra .cnf file should be added with update-texmf). – Marijn Mar 18 at 13:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.