policy-permissive.yaml

# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-License-Identifier: Apache-2.0
#
# Permissive policy for OpenClaw — applied by `shields down`.
# All known OpenClaw-relevant endpoints opened with access: full (no L7 filtering).
# Filesystem: include_workdir: true makes the sandbox home directory writable.
#
# WARNING: This policy disables most sandbox security restrictions.
# Do not use in production.

version: 1

filesystem_policy:
  include_workdir: true
  read_only:
    - /usr
    - /lib
    - /proc
    - /dev/urandom
    - /app
    - /etc
    - /run/nemoclaw/managed-startup-ca-bundle.pem
    - /var/log
    - /var/lib/dpkg                  # Allow package-version inspection without package mutation.
  read_write:
    - /tmp
    - /dev/null
    - /dev/pts                      # devpts PTY access for the tmux-session flow
                                    # (#4513). Mirrors the baseline read_write so
                                    # `shields down` does not remove a path
                                    # (OpenShell rejects filesystem removals).
    - /sandbox/.openclaw
    - /sandbox/.nemoclaw
    - /home/linuxbrew

landlock:
  compatibility: best_effort

process:
  run_as_user: sandbox
  run_as_group: sandbox

network_policies:

  nvidia:
    name: nvidia
    endpoints:
      - host: integrate.api.nvidia.com
        port: 443
        protocol: rest
        enforcement: enforce
        access: full
    binaries:
      - { path: "/**" }

  github:
    name: github
    endpoints:
      - host: github.com
        port: 443
        protocol: rest
        enforcement: enforce
        access: full
      - host: api.github.com
        port: 443
        protocol: rest
        enforcement: enforce
        access: full
    binaries:
      - { path: "/**" }

  clawhub:
    name: clawhub
    endpoints:
      - host: clawhub.ai
        port: 443
        protocol: rest
        enforcement: enforce
        # TODO(#4104): Remove if ClawHub stops encoding scope separators or
        # OpenShell can preserve this route without an endpoint-level opt-in.
        allow_encoded_slash: true
        access: full
    binaries:
      - { path: "/**" }

  openclaw_api:
    name: openclaw_api
    endpoints:
      - host: openclaw.ai
        port: 443
        protocol: rest
        enforcement: enforce
        access: full
    binaries:
      - { path: "/**" }

  openclaw_docs:
    name: openclaw_docs
    endpoints:
      - host: docs.openclaw.ai
        port: 443
        protocol: rest
        enforcement: enforce
        access: full
    binaries:
      - { path: "/**" }

  npm_registry:
    name: npm_registry
    endpoints:
      - host: registry.npmjs.org
        port: 443
        protocol: rest
        enforcement: enforce
        access: full
      - host: registry.yarnpkg.com
        port: 443
        protocol: rest
        enforcement: enforce
        access: full
    binaries:
      - { path: "/**" }

  # ── Messaging endpoints ──

  telegram:
    name: telegram
    endpoints:
      - host: api.telegram.org
        port: 443
        protocol: rest
        enforcement: enforce
        access: full
    binaries:
      - { path: "/**" }

  discord:
    name: discord
    endpoints:
      - host: discord.com
        port: 443
        protocol: rest
        enforcement: enforce
        access: full
      - host: gateway.discord.gg
        port: 443
        protocol: websocket
        enforcement: enforce
        websocket_credential_rewrite: true
        rules:
          - allow: { method: GET, path: "/**" }
          - allow: { method: WEBSOCKET_TEXT, path: "/**" }
      - host: "*.discord.gg"
        port: 443
        protocol: websocket
        enforcement: enforce
        websocket_credential_rewrite: true
        rules:
          - allow: { method: GET, path: "/**" }
          - allow: { method: WEBSOCKET_TEXT, path: "/**" }
      - host: cdn.discordapp.com
        port: 443
        protocol: rest
        enforcement: enforce
        access: full
      - host: media.discordapp.net
        port: 443
        protocol: rest
        enforcement: enforce
        access: full
    binaries:
      - { path: "/**" }

  slack:
    name: slack
    endpoints:
      - host: slack.com
        port: 443
        protocol: rest
        enforcement: enforce
        request_body_credential_rewrite: true
        access: full
      - host: api.slack.com
        port: 443
        protocol: rest
        enforcement: enforce
        request_body_credential_rewrite: true
        access: full
      - host: hooks.slack.com
        port: 443
        protocol: rest
        enforcement: enforce
        request_body_credential_rewrite: true
        access: full
      - host: wss-primary.slack.com
        port: 443
        protocol: websocket
        enforcement: enforce
        websocket_credential_rewrite: true
        rules:
          - allow: { method: GET, path: "/**" }
          - allow: { method: WEBSOCKET_TEXT, path: "/**" }
      - host: wss-backup.slack.com
        port: 443
        protocol: websocket
        enforcement: enforce
        websocket_credential_rewrite: true
        rules:
          - allow: { method: GET, path: "/**" }
          - allow: { method: WEBSOCKET_TEXT, path: "/**" }
    binaries:
      - { path: "/**" }

  # ── Third-party services ──

  brew:
    name: brew
    endpoints:
      - host: formulae.brew.sh
        port: 443
        protocol: rest
        enforcement: enforce
        access: full
      - host: ghcr.io
        port: 443
        protocol: rest
        enforcement: enforce
        access: full
      - host: raw.githubusercontent.com
        port: 443
        protocol: rest
        enforcement: enforce
        access: full
      - host: objects.githubusercontent.com
        port: 443
        protocol: rest
        enforcement: enforce
        access: full
      - host: pkg-containers.githubusercontent.com
        port: 443
        protocol: rest
        enforcement: enforce
        access: full
    binaries:
      - { path: "/**" }

  jira:
    name: jira
    endpoints:
      - host: "*.atlassian.net"
        port: 443
        protocol: rest
        enforcement: enforce
        access: full
      - host: api.atlassian.com
        port: 443
        protocol: rest
        enforcement: enforce
        access: full
      - host: auth.atlassian.com
        port: 443
        protocol: rest
        enforcement: enforce
        access: full
    binaries:
      - { path: "/**" }

  outlook:
    name: outlook
    endpoints:
      - host: outlook.office365.com
        port: 443
        protocol: rest
        enforcement: enforce
        access: full
      - host: outlook.office.com
        port: 443
        protocol: rest
        enforcement: enforce
        access: full
      - host: graph.microsoft.com
        port: 443
        protocol: rest
        enforcement: enforce
        access: full
      - host: login.microsoftonline.com
        port: 443
        protocol: rest
        enforcement: enforce
        access: full
    binaries:
      - { path: "/**" }

  huggingface:
    name: huggingface
    endpoints:
      - host: huggingface.co
        port: 443
        protocol: rest
        enforcement: enforce
        access: full
      - host: cdn-lfs.huggingface.co
        port: 443
        protocol: rest
        enforcement: enforce
        access: full
      - host: router.huggingface.co
        port: 443
        protocol: rest
        enforcement: enforce
        access: full
    binaries:
      - { path: "/**" }

  brave:
    name: brave
    endpoints:
      - host: api.search.brave.com
        port: 443
        protocol: rest
        enforcement: enforce
        access: full
    binaries:
      - { path: "/**" }

  # Shields-down policies intentionally keep full host and binary scope. The
  # maintained Tavily preset and provider profiles constrain normal access.
  tavily:
    name: tavily
    endpoints:
      - host: api.tavily.com
        port: 443
        protocol: rest
        enforcement: enforce
        request_body_credential_rewrite: true
        access: full
    binaries:
      - { path: "/**" }