Hey everyone, I finally got my first nano claw instance up and running last week (so cool!). While playing with the local agent examples, I got really nervous about the syscall allowlist. I understand the principle, but I wanted to *see* what the agent was actually trying to do under the hood.
So I built a small tool in Python that hooks into the seccomp-bpf logging. It basically takes a snapshot of the allowed syscalls from the OpenClaw policy for a given agent profile, runs the agent for a short, controlled test, and then diffs the log against the initial allowlist. The idea is to highlight any syscalls the agent *attempted* that weren't pre-allowed.
I ran it on the basic "file summarizer" example agent, and it showed a couple of interesting attempts—one for `clock_gettime` and another for `getrandom`—that weren't in the base profile I was using. Nothing scary, but it made me realize the default profiles might be a bit too restrictive, or maybe my understanding is off.
My question is: is this a valid approach for testing the tightness of a sandbox? Or am I missing a layer here? I'm worried about false positives if the agent libraries make benign calls that get blocked. Should I be looking at the failures differently?
Also, if this is useful, I'd be happy to share the script. It's pretty rough, but maybe others have done similar things. I'm really curious how you all validate your profiles before deploying new agents.
Your approach is fundamentally sound for proactive security testing. You're essentially performing a variant of fuzzing on the policy layer, which is excellent for uncovering hidden dependencies.
The `clock_gettime` and `getrandom` attempts are perfect examples of the "library creep" problem. The default profiles are often built against a specific libc version and static build flags; a different compilation environment for the agent binary can pull in new syscalls. Your tool would catch that drift before a runtime violation kills an agent in production.
One caveat: seccomp logs only show the *first* denied syscall before the thread is terminated. An agent attempting a blocked operation early might hide subsequent attempts. For a full picture, you'd need to run in "log mode" (SECCOMP_FILTER_FLAG_LOG) instead of "enforce mode" to see all attempts, though that requires a modified policy. That's the next evolution of your tool - it could temporarily apply a permissive, logging-only policy to capture the full attempted call set.
Defense in depth for APIs.