docs: def IsExecutionWhitelisted(cmd, args):
    """Check if a binary and args is whitelisted.
  
    Args:
      cmd: Canonical path to the binary.
      args: List of arguments to be passed to the binary.
  
    Returns:
      Bool, True if it is whitelisted.
  
    These whitelists could also go in the platform specific client files
    client_utils_<platform>.py. We chose to leave them here instead of putting
    them in global arrays to discourage people coding other modules from adding
    new commands to the whitelist before running them.
    The idea is to have a single place that lists every command we can run during
    normal operation (obviously doesn't catch the special cases where we bypass
    the list).
    A deployment-specific list is also checked (see local/binary_whitelist.py).
    """
    if platform.system() == "Windows":
      whitelist = [
          ("arp.exe", ["-a"]),
          ("driverquery.exe", ["/v"]),
          ("ipconfig.exe", ["/all"]),
          ("netsh.exe", ["advfirewall", "firewall", "show", "rule", "name=all"]),
          ("netsh.exe",
           ["advfirewall", "monitor", "show", "firewall", "rule", "name=all"]),
          ("tasklist.exe", ["/SVC"]),
          ("tasklist.exe", ["/v"]),
      ]
    elif platform.system() == "Linux":
      whitelist = [
          ("/bin/df", []),
          ("/bin/echo", ["1"]),
          ("/bin/rpm", ["-qa"]),
          ("/bin/sleep", ["10"]),
          ("/sbin/auditctl", ["-l"]),
          ("/sbin/ifconfig", ["-a"]),
          ("/sbin/iptables", ["-L", "-n", "-v"]),
          ("/sbin/lsmod", []),
          ("/usr/bin/dpkg", ["--list"]),
          ("/usr/bin/last", []),
          ("/usr/bin/yum", ["list", "installed", "-q"]),
          ("/usr/bin/yum", ["repolist", "-v", "-q"]),
          ("/usr/bin/who", []),
          ("/usr/sbin/arp", ["-a"]),
          ("/usr/sbin/dmidecode", ["-q"]),
          ("/usr/sbin/sshd", ["-T"]),
      ]
    elif platform.system() == "Darwin":
      whitelist = [
          ("/bin/echo", ["1"]),
          ("/bin/launchctl", ["unload", config.CONFIG["Client.plist_path"]]),
          ("/usr/bin/hdiutil", ["info"]),
          ("/usr/bin/last", []),
          ("/usr/bin/who", []),
          ("/usr/sbin/arp", ["-a"]),
          ("/usr/sbin/kextstat", []),
          ("/usr/sbin/system_profiler", ["-xml", "SPHardwareDataType"]),
          ("/usr/libexec/firmwarecheckers/ethcheck/ethcheck", ["--show-hashes"]),
      ]
    else:
      whitelist = []
  
    for (allowed_cmd, allowed_args) in whitelist:
      if cmd == allowed_cmd and args == allowed_args:
        return True
  
    # Check if this is whitelisted locally.
    if binary_whitelist.IsExecutionWhitelisted(cmd, args):
      return True
  
    return False