harden sandbox against agent config tampering (defense-in-depth)#654

Open

BenediktSchackenberg wants to merge 8 commits intoNVIDIA:mainfrom

BenediktSchackenberg:fix/sandbox-config-hardening

Commits on Mar 23, 2026

docs: document workspace file persistence and add backup/restore guide
BenediktSchackenberg
committed
fix: address all review comments on PR #476
BenediktSchackenberg
committed
harden sandbox config: tool policy deny list, move config to /etc, lock parent dir
BenediktSchackenberg
committed
fix: run /etc/openclaw setup as root, move runtime config to /tmp
BenediktSchackenberg
committed
fix: address CodeRabbit review comments on PR #654
BenediktSchackenberg
committed
fix: deny write/edit on /tmp runtime config too
BenediktSchackenberg
committed
fix: address CodeRabbit review — chmod, formatting, remove ineffective exec commands deny
BenediktSchackenberg
committed
fix: close TOCTOU window on /tmp/openclaw/, ensure workspace+agents ownership
BenediktSchackenberg
committed