TexStudio with arara; cannot find extractbb

Question

With some help from the prior question TexStudio and arara, I was able to get started with arara inside TexStudio (Yay!). But while running a Xelatex compilation (the 2nd example code in the URL just noted), I got this error message (it did not finish compiling):

(/usr/local/texlive/2022/texmf-dist/tex/latex/supertabular/supertabular.sty
))
(/usr/local/texlive/2022/texmf-dist/tex/latex/glossaries/styles/glossary-tree.s
ty
))
(/usr/local/texlive/2022/texmf-dist/tex/latex/l3backend/l3backend-xetex.def
! I can't find file `"|extractbb --version"'.
<to be read again> 
                   \scan_stop: 
l.72     \l__sys_internal_tl
                            
(Press Enter to retry, or Control-D to exit)
Please type another input file name: 
runpopen command not allowed: extractbb

extractbb does exist and (on my machine) it is at /usr/local/texlive/2022/bin/x86_64-linux/extractbb

Just a guess: Is it possible that this is not so much a problem with the path ('I can't find file `"|extractbb --version'), but perhaps with shell permission instead (runpopen command not allowed : extractbb)??? Any suggestions on how to fix would be appreciated!

------edit, follow David Carlisle's comment regards texmf.cfg-----

My only customizations for my "personal" texmf.cfg is the addition of

shell_escape_commands = pagelayoutapi

whereas the un-altered, "general" texmf.cfg at /usr/local/texlive/2022/texmf-dist/web2c/texmf.cnf indicates that

% The default is true, because we already avoid adding the standard
% extension(s) in the usual cases.  E.g., babel.sty will only look for
% babel.sty, not babel.sty.tex, regardless of this setting.
try_std_extension_first = t

% Enable system commands via \write18{...}.  When enabled fully (set to
% t), obviously insecure.  When enabled partially (set to p), only the
% commands listed in shell_escape_commands are allowed.  Although this
% is not fully secure either, it is much better, and so useful that we
% enable it for everything but bare tex.
shell_escape = p

% No spaces in this command list.
% 
% The programs listed here are as safe as any we know: they either do
% not write any output files, respect openout_any, or have hard-coded
% restrictions similar to or higher than openout_any=p.  They also have
% no features to invoke arbitrary other programs, and no known
% exploitable bugs.  All to the best of our knowledge.  They also have
% practical use for being called from TeX.
% 
shell_escape_commands = \
bibtex,bibtex8,\
extractbb,\
gregorio,\
kpsewhich,\
makeindex,\
repstopdf,\
r-mpost,\
texosquery-jre8,\

EDIT--response to egreg's answer I looked again at/usr/local/texlive/2022/texmf.cnf because, although egreg's changes did in fact resolve the problem, the instructions (provided as comments within the file) are contrary, they indicate that you should ONLY put the changes into that file, NOT all of the original lines present at /usr/local/texlive/2022/texmf-dist/web2c/texmf.cnf:

% (Public domain.)
% This texmf.cnf file should contain only your personal changes from the
% original texmf.cnf (for example, as chosen in the installer).
%
% That is, if you need to make changes to texmf.cnf, put your custom
% settings in this file, which is .../texlive/YYYY/texmf.cnf, rather than
% the distributed file (which is .../texlive/YYYY/texmf-dist/web2c/texmf.cnf).
% And include *only* your changed values, *NOT A COPY OF THE WHOLE THING!* [caps added here for emphasis--Birdman]
%

I am continuing this conversation because I'd like to know whether I've somehow misinterpreted this admonition (--> to not copy the whole thing), or whether those instructional comments are themselves faulty.

Answer 1

It's definitely your modification's fault. With

shell_escape_commands = pagelayoutapi

you are allowing only the application pagelayoutapi in the restricted shell-escape. If you try

kpsewhich --var-value shell_escape_commands

from the command line, you should just see

pagelayoutapi

(just tried out on my machine).

You need to copy the whole list and append to it, when modifying the upper level texmf.cnf file:

shell_escape_commands = \
bibtex,bibtex8,\
extractbb,\
gregorio,\
kpsewhich,\
makeindex,\
repstopdf,\
r-mpost,\
texosquery-jre8,\
pagelayoutapi,\

How does reading texmf.cnf work?

There are usually two texmf.cnf files in the TeX tree. One is at the top level, the other one is in texmf-dist. The output of

kpsewhich -a texmf.cnf

on my machine is

/usr/local/texlive/2022/texmf.cnf
/usr/local/texlive/2022/texmf-dist/web2c/texmf.cnf

There may be more of these files, but the essential thing to know is that they're read in the order shown by kpsewhich -a.

Values of variables that are set in a file are not overridden by later files. There is a recommendation in the “main” (but last read) file, namely

% That is, if you need to make changes to texmf.cnf, put your custom
% settings in this file, which is .../texlive/YYYY/texmf.cnf, rather than
% the distributed file (which is .../texlive/YYYY/texmf-dist/web2c/texmf.cnf).
% And include *only* your changed values, *NOT A COPY OF THE WHOLE THING!* [caps added here for emphasis--Birdman]

The “NOT A COPY OF THE WHOLE THING” refers to not adding every variable, but only those you need to change the value of. If you add everything, initialization would be slower, because many values would need to be read and discarded.

If you say in the top level texmf.cnf file

shell_escape_commands =

no external program is allowed in the restricted shell. The variables are not set incrementally: later lines starting with that value are ignored.