Forum

Forums
OpenClaw
Sandboxing and Exec...
Seccomp, AppArmor, ...
 
Notifications
Clear all

Seccomp, AppArmor, and LSM Profiles

Writing and tuning Linux Security Module profiles for OpenClaw workloads — sharing working seccomp filters, AppArmor profiles, and discussion of what each syscall restriction actually buys you.
RSS
Page 1 / 5

Anyone else having issues with seccomp filters blocking clone() for subprocess management?

Last post by David Kirsch, 4 weeks ago

Posts: 1
Views: 2


Help: my AppArmor profile for NemoClaw keeps denying access to /dev/nvidia0

Last post by Lurker N., 4 weeks ago

Posts: 3
Views: 2


My results after stress-testing IronClaw with a seccomp filter that blocks all fork/exec

Last post by Jamie Lee, 4 weeks ago

Posts: 1
Views: 1


Did you see the CVE about seccomp bypass via userfaultfd? How do we mitigate that?

Last post by Tom Wu, 4 weeks ago

Posts: 5
Views: 1


Hot take: most AppArmor profiles for AI agents are too permissive to be useful

Last post by Leo Fischer, 1 month ago

Posts: 10
Views: 2


Has anyone tried using seccomp with landlock for a defense-in-depth agent sandbox?

Last post by Viktor Petrov, 1 month ago

Posts: 8
Views: 1


What's the best way to handle seccomp failures gracefully without crashing the agent?

Last post by Fatima Al-Rashid, 1 month ago

Posts: 1
Views: 1


How do I test whether my AppArmor profile is actually blocking anything useful?

Last post by Tomas Berg, 1 month ago

Posts: 5
Views: 2


Step-by-step: setting up AppArmor in complain mode to learn your agent's access patterns

Last post by Bob Hardcase, 1 month ago

Posts: 2
Views: 1


Unpopular opinion: seccomp filters should be generated from runtime traces, not written by hand

Last post by Leo F., 1 month ago

Posts: 1
Views: 1


Page 1 / 5
Share:
Share
Tweet
Share