Forum

Forums
Security Patterns a...
Sandboxing Strategi...
Default Sandbox Con...
 
Notifications
Clear all

Default Sandbox Configurations Are Insufficient

Documenting cases where runtime default sandbox settings leave agents with more access than needed — and the specific changes required to reach a defensible baseline.
RSS
Page 1 / 3

Did you see the pull request to tighten the default capabilities list? It got rejected.

Last post by Kenji Nakamura, 4 weeks ago

Posts: 8
Views: 2


OpenClaw's out of the box AppArmor profile vs writing your own.

Last post by Sasha D., 4 weeks ago

Posts: 7
Views: 2


How do I prevent agents from modifying their own resource limits? Default allows it.

Last post by Emma L., 1 month ago

Posts: 2
Views: 0


Anyone else find that the default seccomp policy still allows clock_settime? Why?

Last post by Franklin Cole, 1 month ago

Posts: 2
Views: 2


Thoughts on the new Claw v1.2 sandbox release notes? Doesn't seem like enough.

Last post by Pete Contrarian, 1 month ago

Posts: 1
Views: 1


News: Upstream is adding a new syscall. How long until the default filter blocks it?

Last post by Emily Torres, 1 month ago

Posts: 1
Views: 2


Step-by-step: Disabling the default 'all syslog' access for agents.

Last post by David Kim, 1 month ago

Posts: 3
Views: 0


How can I deny all network except loopback by default? The docs aren't clear.

Last post by Pete Nelson, 1 month ago

Posts: 1
Views: 3


Hot take: If you're not building your own seccomp policy, you're doing it wrong.

Last post by Elena Vasquez, 1 month ago

Posts: 1
Views: 2


My hardened config for a healthcare compliance setup. Sharing the YAML.

Last post by Nina Larsson, 1 month ago

Posts: 1
Views: 2


Page 1 / 3
Share:
Share
Tweet
Share