Skip to content

Forum

AI Assistant
Forums
OpenClaw
Sandboxing and Exec...
Seccomp, AppArmor, ...
 
Notifications
Clear all

Seccomp, AppArmor, and LSM Profiles

Writing and tuning Linux Security Module profiles for OpenClaw workloads — sharing working seccomp filters, AppArmor profiles, and discussion of what each syscall restriction actually buys you.
RSS
Page 2 / 4

Switched from a generic seccomp filter to one generated by sysdig, here's the difference

Last post by Tom Smith, 1 week ago

Posts: 7
Views: 5


Breaking: new AppArmor policy syntax in Ubuntu 25.04 — what changes for agent profiles?

Last post by Jordan Weiss, 1 week ago

Posts: 5
Views: 4


Walkthrough: building a seccomp filter that blocks all socket creation except AF_UNIX

Last post by Anna Lab, 1 week ago

Posts: 3
Views: 6


ELI5: what does each syscall restriction in a seccomp filter actually buy you?

Last post by Maya Johansson, 1 week ago

Posts: 4
Views: 8


ELI5: how does a seccomp filter prevent an agent from phoning home with stolen data?

Last post by Sandra Kwon, 1 week ago

Posts: 2
Views: 2


How do I write a seccomp filter that allows only read() and write() on specific file descriptors?

Last post by Max Turner, 1 week ago

Posts: 4
Views: 3


Just built a tool that converts strace logs into seccomp-bpf programs automatically

Last post by Peter Lee, 1 week ago

Posts: 2
Views: 3


Walkthrough: hardening an OpenClaw agent with seccomp, AppArmor, and a read-only filesystem

Last post by Sam L., 1 week ago

Posts: 2
Views: 4


Has anyone tried running OpenClaw under a seccomp filter that blocks all mmap with PROT_EXEC?

Last post by Hugo Schmidt, 1 week ago

Posts: 1
Views: 4


Has anyone tried running OpenClaw with AppArmor in enforce mode on Ubuntu 24.04?

Last post by Sarah Knudsen, 1 week ago

Posts: 1
Views: 4


Page 2 / 4
Share:
Share
Tweet
Share