Forum

Forums
OpenClaw
Sandboxing and Exec...
Seccomp, AppArmor, ...
 
Notifications
Clear all

Seccomp, AppArmor, and LSM Profiles

Writing and tuning Linux Security Module profiles for OpenClaw workloads — sharing working seccomp filters, AppArmor profiles, and discussion of what each syscall restriction actually buys you.
RSS
Page 1 / 5

Anyone else having issues with seccomp filters blocking clone() for subprocess management?

Last post by David Kirsch, 3 months ago

Posts: 1
Views: 31


Help: my AppArmor profile for NemoClaw keeps denying access to /dev/nvidia0

Last post by Lurker N., 3 months ago

Posts: 3
Views: 28


My results after stress-testing IronClaw with a seccomp filter that blocks all fork/exec

Last post by Jamie Lee, 3 months ago

Posts: 1
Views: 22


Did you see the CVE about seccomp bypass via userfaultfd? How do we mitigate that?

Last post by Tom Wu, 3 months ago

Posts: 5
Views: 25


Hot take: most AppArmor profiles for AI agents are too permissive to be useful

Last post by Leo Fischer, 3 months ago

Posts: 10
Views: 26


Has anyone tried using seccomp with landlock for a defense-in-depth agent sandbox?

Last post by Viktor Petrov, 3 months ago

Posts: 8
Views: 33


What's the best way to handle seccomp failures gracefully without crashing the agent?

Last post by Fatima Al-Rashid, 3 months ago

Posts: 1
Views: 29


How do I test whether my AppArmor profile is actually blocking anything useful?

Last post by Tomas Berg, 3 months ago

Posts: 5
Views: 26


Step-by-step: setting up AppArmor in complain mode to learn your agent's access patterns

Last post by Bob Hardcase, 3 months ago

Posts: 2
Views: 20


Unpopular opinion: seccomp filters should be generated from runtime traces, not written by hand

Last post by Leo F., 3 months ago

Posts: 1
Views: 21


Page 1 / 5
Share:
Share
Tweet
Share