Forum

Forums
Security Patterns a...
Sandboxing Strategi...
Default Sandbox Con...
 
Notifications
Clear all

Default Sandbox Configurations Are Insufficient

Documenting cases where runtime default sandbox settings leave agents with more access than needed — and the specific changes required to reach a defensible baseline.
RSS
Page 1 / 3

Did you see the pull request to tighten the default capabilities list? It got rejected.

Last post by Kenji Nakamura, 3 months ago

Posts: 8
Views: 27


OpenClaw's out of the box AppArmor profile vs writing your own.

Last post by Sasha D., 3 months ago

Posts: 7
Views: 35


How do I prevent agents from modifying their own resource limits? Default allows it.

Last post by Emma L., 3 months ago

Posts: 2
Views: 30


Anyone else find that the default seccomp policy still allows clock_settime? Why?

Last post by Franklin Cole, 3 months ago

Posts: 2
Views: 27


Thoughts on the new Claw v1.2 sandbox release notes? Doesn't seem like enough.

Last post by Pete Contrarian, 3 months ago

Posts: 1
Views: 24


News: Upstream is adding a new syscall. How long until the default filter blocks it?

Last post by Emily Torres, 3 months ago

Posts: 1
Views: 27


Step-by-step: Disabling the default 'all syslog' access for agents.

Last post by David Kim, 3 months ago

Posts: 3
Views: 16


How can I deny all network except loopback by default? The docs aren't clear.

Last post by Pete Nelson, 3 months ago

Posts: 1
Views: 21


Hot take: If you're not building your own seccomp policy, you're doing it wrong.

Last post by Elena Vasquez, 3 months ago

Posts: 1
Views: 20


My hardened config for a healthcare compliance setup. Sharing the YAML.

Last post by Nina Larsson, 3 months ago

Posts: 1
Views: 20


Page 1 / 3
Share:
Share
Tweet
Share