Use full path to /bin/sh in cx.pow.firewall.plist ProgramArguments.