Skip to content

refactor(sandbox): skip redundant capability drops #11632

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ericksoa merged 9 commits into from
Sep 13, 2026
Merged

refactor(sandbox): skip redundant capability drops #11632

Show file tree
Hide file tree
Changes from 7 commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
32f8c01
refactor(sandbox): skip redundant capability drops
ericksoa Sep 12, 2026
179ff8b
test(sandbox): type capability fixture options
ericksoa Sep 12, 2026
e5eb469
fix(sandbox): preserve legacy capability transitions
ericksoa Sep 12, 2026
202ae86
merge: refresh validation process supervision
ericksoa Sep 12, 2026
a077f92
fix(images): refresh unavailable Debian runtime pins
ericksoa Sep 12, 2026
1b6a655
fix(images): align Python security package with Debian u5
ericksoa Sep 12, 2026
01efe7c
fix(images): align qualification inputs
ericksoa Sep 12, 2026
67386fa
merge: consume published image prerequisite fixes
ericksoa Sep 12, 2026
2cf275c
Merge remote-tracking branch 'origin/main' into refactor/11259-opensh…
ericksoa Sep 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .github/workflows/managed-images.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -204,6 +204,7 @@ jobs:
done
for support_relative in \
scripts/lib/bundled-npm-package.mts \
scripts/security/build-native-security-packages.sh \
scripts/security/patches/perl-5.44.0-net-ping-capability-tests.patch
do
support_source="$candidate_root/$support_relative"
Expand Down
6 changes: 3 additions & 3 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -734,7 +734,7 @@ RUN set -eu; \
apt-get install -y --no-install-recommends procps=2:4.0.4-9; \
fi; \
if [ "$needs_chattr" = "1" ]; then \
apt-get install -y --no-install-recommends e2fsprogs=1.47.2-3+b11; \
apt-get install -y --no-install-recommends e2fsprogs=1.47.2-3+b12; \
fi; \
if [ "$needs_tmux" = "1" ]; then \
apt-get install -y --no-install-recommends tmux=3.5a-3; \
Expand Down Expand Up @@ -2428,7 +2428,7 @@ RUN set -eu; \
"vim-tiny=2:9.2.0858-1" \
"libssh2-1t64=1.11.1-1+deb13u1+nemoclaw2" \
"libssl3t64=3.5.7-1~deb13u2" \
"nemoclaw-python3.13-htmlparser-fix=3.13.5-2+deb13u4+nemoclaw1" \
"nemoclaw-python3.13-htmlparser-fix=3.13.5-2+deb13u5+nemoclaw1" \
"perl-base=5.44.0-1nemoclaw1" \
"perl=5.44.0-1nemoclaw1" \
"libevent-core-2.1-7t64=2.1.13-stable-1" \
Expand All @@ -2441,7 +2441,7 @@ RUN set -eu; \
test "$(dpkg-query -W -f='${Version}' vim-tiny)" = "2:9.2.0858-1"; \
test "$(dpkg-query -W -f='${Version}' libssh2-1t64)" = "1.11.1-1+deb13u1+nemoclaw2"; \
test "$(dpkg-query -W -f='${Version}' libssl3t64)" = "3.5.7-1~deb13u2"; \
test "$(dpkg-query -W -f='${Version}' nemoclaw-python3.13-htmlparser-fix)" = "3.13.5-2+deb13u4+nemoclaw1"; \
test "$(dpkg-query -W -f='${Version}' nemoclaw-python3.13-htmlparser-fix)" = "3.13.5-2+deb13u5+nemoclaw1"; \
test "$(dpkg-query -W -f='${Version}' perl-base)" = "5.44.0-1nemoclaw1"; \
test "$(dpkg-query -W -f='${Version}' perl)" = "5.44.0-1nemoclaw1"; \
test "$(dpkg-query -W -f='${Version}' libevent-core-2.1-7t64)" = "2.1.13-stable-1"; \
Expand Down
12 changes: 6 additions & 6 deletions Dockerfile.base
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,7 +64,7 @@ FROM node:22-trixie-slim@sha256:db8a96a63e5264607ada2d206758876ebbed6a12be2ada75
RUN apt-get update && apt-get install -y --no-install-recommends \
build-essential=12.12 \
ca-certificates=20250419 \
curl=8.14.1-2+deb13u4 \
curl=8.14.1-2+deb13u5 \
Comment thread
ericksoa marked this conversation as resolved.
Resolved
git=1:2.47.3-0+deb13u1 \
libssl-dev=3.5.7-1~deb13u2 \
openssh-server=1:10.0p1-7+deb13u4 \
Expand Down Expand Up @@ -119,18 +119,18 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
python3=3.13.5-1 \
python3-pip=25.1.1+dfsg-1 \
python3-venv=3.13.5-1 \
curl=8.14.1-2+deb13u4 \
curl=8.14.1-2+deb13u5 \
git=1:2.47.3-0+deb13u1 \
gnupg=2.4.7-21+deb13u1 \
ca-certificates=20250419 \
iproute2=6.15.0-1 \
iptables=1.8.11-2 \
nftables=1.1.3-1 \
libcap2-bin=1:2.75-10+deb13u1+b1 \
libcap2-bin=1:2.75-10+deb13u1+b3 \
libssl3t64=3.5.7-1~deb13u2 \
util-linux=2.41-5 \
procps=2:4.0.4-9 \
e2fsprogs=1.47.2-3+b11 \
e2fsprogs=1.47.2-3+b12 \
"dos2unix=7.5.2-1*" \
libonig5=6.9.9-1+b1 \
openssh-sftp-server=1:10.0p1-7+deb13u4 \
Expand Down Expand Up @@ -219,7 +219,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
&& test "$(dpkg-query -W -f='${Version}' vim-tiny)" = "2:9.2.0858-1" \
&& test "$(dpkg-query -W -f='${Version}' libssh2-1t64)" = "1.11.1-1+deb13u1+nemoclaw2" \
&& test "$(dpkg-query -W -f='${Version}' libssl3t64)" = "3.5.7-1~deb13u2" \
&& test "$(dpkg-query -W -f='${Version}' nemoclaw-python3.13-htmlparser-fix)" = "3.13.5-2+deb13u4+nemoclaw1" \
&& test "$(dpkg-query -W -f='${Version}' nemoclaw-python3.13-htmlparser-fix)" = "3.13.5-2+deb13u5+nemoclaw1" \
&& test "$(dpkg-query -W -f='${Version}' perl)" = "$perl_version_before" \
&& test "$(jq --version)" = "jq-1.8.2" \
&& ldd /usr/bin/jq | grep -Eq 'libonig[.]so[.]5' \
Expand All @@ -246,7 +246,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
"vim-tiny=2:9.2.0858-1" \
"libssh2-1t64=1.11.1-1+deb13u1+nemoclaw2" \
"libssl3t64=3.5.7-1~deb13u2" \
"nemoclaw-python3.13-htmlparser-fix=3.13.5-2+deb13u4+nemoclaw1" \
"nemoclaw-python3.13-htmlparser-fix=3.13.5-2+deb13u5+nemoclaw1" \
> /usr/local/share/nemoclaw/security-packages.txt \
&& chown root:root /usr/local/share/nemoclaw/security-packages.txt \
&& chmod 0644 /usr/local/share/nemoclaw/security-packages.txt \
Expand Down
6 changes: 3 additions & 3 deletions agents/hermes/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@
# Layers PR-specific code (plugin, config, startup script) on top of the
# pre-built Hermes base image. Mirrors the OpenClaw Dockerfile structure.

ARG BASE_IMAGE=ghcr.io/nvidia/nemoclaw/hermes-sandbox-base@sha256:c588bf76ba1c280f8a366bdfd672193e852de4f509a280662c7070a9b6e2fa48
ARG BASE_IMAGE=ghcr.io/nvidia/nemoclaw/hermes-sandbox-base@sha256:be209965cd1550dc0ab691924e4499643552fc87cb037315d66dc10793476c6f
ARG NEMOCLAW_CORPORATE_CA_B64=
ARG NEMOCLAW_MANAGED_IMAGE_CAPABILITY_UNION=0
# BuildKit supplies this automatic platform argument. The Portable staged
Expand Down Expand Up @@ -1726,7 +1726,7 @@ RUN set -eu; \
"vim-tiny=2:9.2.0858-1" \
"libssh2-1t64=1.11.1-1+deb13u1+nemoclaw2" \
"libssl3t64=3.5.7-1~deb13u2" \
"nemoclaw-python3.13-htmlparser-fix=3.13.5-2+deb13u4+nemoclaw1" \
"nemoclaw-python3.13-htmlparser-fix=3.13.5-2+deb13u5+nemoclaw1" \
"perl-base=5.44.0-1nemoclaw1" \
"perl=5.44.0-1nemoclaw1" \
| cmp -s - "$security_inventory"; \
Expand All @@ -1738,7 +1738,7 @@ RUN set -eu; \
test "$(dpkg-query -W -f='${Version}' vim-tiny)" = "2:9.2.0858-1"; \
test "$(dpkg-query -W -f='${Version}' libssh2-1t64)" = "1.11.1-1+deb13u1+nemoclaw2"; \
test "$(dpkg-query -W -f='${Version}' libssl3t64)" = "3.5.7-1~deb13u2"; \
test "$(dpkg-query -W -f='${Version}' nemoclaw-python3.13-htmlparser-fix)" = "3.13.5-2+deb13u4+nemoclaw1"; \
test "$(dpkg-query -W -f='${Version}' nemoclaw-python3.13-htmlparser-fix)" = "3.13.5-2+deb13u5+nemoclaw1"; \
test "$(dpkg-query -W -f='${Version}' perl-base)" = "5.44.0-1nemoclaw1"; \
test "$(dpkg-query -W -f='${Version}' perl)" = "5.44.0-1nemoclaw1"; \
test "$(perl -e 'print $^V')" = "v5.44.0"; \
Expand Down
14 changes: 7 additions & 7 deletions agents/hermes/Dockerfile.base
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ FROM node:24-trixie-slim@sha256:05c08ce4291e9a58f59456a7985176defb12cdd42271f35f
RUN apt-get update && apt-get install -y --no-install-recommends \
build-essential=12.12 \
ca-certificates=20250419 \
curl=8.14.1-2+deb13u4 \
curl=8.14.1-2+deb13u5 \
git=1:2.47.3-0+deb13u1 \
libssl-dev=3.5.7-1~deb13u2 \
openssh-server=1:10.0p1-7+deb13u4 \
Expand Down Expand Up @@ -96,20 +96,20 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
python3=3.13.5-1 \
python3-pip=25.1.1+dfsg-1 \
python3-venv=3.13.5-1 \
curl=8.14.1-2+deb13u4 \
curl=8.14.1-2+deb13u5 \
git=1:2.47.3-0+deb13u1 \
gnupg=2.4.7-21+deb13u1 \
ca-certificates=20250419 \
iproute2=6.15.0-1 \
iptables=1.8.11-2 \
nftables=1.1.3-1 \
libcap2-bin=1:2.75-10+deb13u1+b1 \
libcap2-bin=1:2.75-10+deb13u1+b3 \
libssl3t64=3.5.7-1~deb13u2 \
util-linux=2.41-5 \
procps=2:4.0.4-9 \
e2fsprogs=1.47.2-3+b11 \
e2fsprogs=1.47.2-3+b12 \
openssh-sftp-server=1:10.0p1-7+deb13u4 \
socat=1.8.0.3-1 \
socat=1.8.0.3-1+deb13u1 \
"dos2unix=7.5.2-1*" \
&& arch="$(dpkg --print-architecture)" \
&& case "$arch" in \
Expand Down Expand Up @@ -189,7 +189,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
&& test "$(dpkg-query -W -f='${Version}' vim-tiny)" = "2:9.2.0858-1" \
&& test "$(dpkg-query -W -f='${Version}' libssh2-1t64)" = "1.11.1-1+deb13u1+nemoclaw2" \
&& test "$(dpkg-query -W -f='${Version}' libssl3t64)" = "3.5.7-1~deb13u2" \
&& test "$(dpkg-query -W -f='${Version}' nemoclaw-python3.13-htmlparser-fix)" = "3.13.5-2+deb13u4+nemoclaw1" \
&& test "$(dpkg-query -W -f='${Version}' nemoclaw-python3.13-htmlparser-fix)" = "3.13.5-2+deb13u5+nemoclaw1" \
&& test "$(jq --version)" = "jq-1.8.2" \
&& ldd /usr/bin/jq | grep -Eq 'libonig[.]so[.]5' \
&& printf '%s\n' '{"sandbox":"healthy"}' | jq -e '.sandbox == "healthy"' >/dev/null \
Expand Down Expand Up @@ -224,7 +224,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
"vim-tiny=2:9.2.0858-1" \
"libssh2-1t64=1.11.1-1+deb13u1+nemoclaw2" \
"libssl3t64=3.5.7-1~deb13u2" \
"nemoclaw-python3.13-htmlparser-fix=3.13.5-2+deb13u4+nemoclaw1" \
"nemoclaw-python3.13-htmlparser-fix=3.13.5-2+deb13u5+nemoclaw1" \
"perl-base=5.44.0-1nemoclaw1" \
"perl=5.44.0-1nemoclaw1" \
> /usr/local/share/nemoclaw/security-packages.txt \
Expand Down
4 changes: 2 additions & 2 deletions agents/langchain-deepagents-code/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -415,7 +415,7 @@ RUN set -eu; \
"vim-tiny=2:9.2.0858-1" \
"libssh2-1t64=1.11.1-1+deb13u1+nemoclaw2" \
"libssl3t64=3.5.7-1~deb13u2" \
"nemoclaw-python3.13-htmlparser-fix=3.13.5-2+deb13u4+nemoclaw1" \
"nemoclaw-python3.13-htmlparser-fix=3.13.5-2+deb13u5+nemoclaw1" \
"perl-base=5.44.0-1nemoclaw1" \
"perl=5.44.0-1nemoclaw1" \
| cmp -s - "$security_inventory"; \
Expand All @@ -427,7 +427,7 @@ RUN set -eu; \
test "$(dpkg-query -W -f='${Version}' vim-tiny)" = "2:9.2.0858-1"; \
test "$(dpkg-query -W -f='${Version}' libssh2-1t64)" = "1.11.1-1+deb13u1+nemoclaw2"; \
test "$(dpkg-query -W -f='${Version}' libssl3t64)" = "3.5.7-1~deb13u2"; \
test "$(dpkg-query -W -f='${Version}' nemoclaw-python3.13-htmlparser-fix)" = "3.13.5-2+deb13u4+nemoclaw1"; \
test "$(dpkg-query -W -f='${Version}' nemoclaw-python3.13-htmlparser-fix)" = "3.13.5-2+deb13u5+nemoclaw1"; \
test "$(dpkg-query -W -f='${Version}' perl-base)" = "5.44.0-1nemoclaw1"; \
test "$(dpkg-query -W -f='${Version}' perl)" = "5.44.0-1nemoclaw1"; \
test "$(perl -e 'print $^V')" = "v5.44.0"; \
Expand Down
12 changes: 6 additions & 6 deletions agents/langchain-deepagents-code/Dockerfile.base
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ ARG NEMOCLAW_CORPORATE_CA_B64
RUN apt-get update && apt-get install -y --no-install-recommends \
build-essential=12.12 \
ca-certificates=20250419 \
curl=8.14.1-2+deb13u4 \
curl=8.14.1-2+deb13u5 \
git=1:2.47.3-0+deb13u1 \
libssl-dev=3.5.7-1~deb13u2 \
openssh-server=1:10.0p1-7+deb13u4 \
Expand Down Expand Up @@ -87,17 +87,17 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
python3=3.13.5-1 \
python3-pip=25.1.1+dfsg-1 \
python3-venv=3.13.5-1 \
curl=8.14.1-2+deb13u4 \
curl=8.14.1-2+deb13u5 \
git=1:2.47.3-0+deb13u1 \
ca-certificates=20250419 \
iproute2=6.15.0-1 \
iptables=1.8.11-2 \
nftables=1.1.3-1 \
libcap2-bin=1:2.75-10+deb13u1+b1 \
libcap2-bin=1:2.75-10+deb13u1+b3 \
libssl3t64=3.5.7-1~deb13u2 \
util-linux=2.41-5 \
procps=2:4.0.4-9 \
e2fsprogs=1.47.2-3+b11 \
e2fsprogs=1.47.2-3+b12 \
"dos2unix=7.5.2-1*" \
openssh-sftp-server=1:10.0p1-7+deb13u4 \
ripgrep=14.1.1-1+b4 \
Expand Down Expand Up @@ -191,7 +191,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
&& test "$(dpkg-query -W -f='${Version}' vim-tiny)" = "2:9.2.0858-1" \
&& test "$(dpkg-query -W -f='${Version}' libssh2-1t64)" = "1.11.1-1+deb13u1+nemoclaw2" \
&& test "$(dpkg-query -W -f='${Version}' libssl3t64)" = "3.5.7-1~deb13u2" \
&& test "$(dpkg-query -W -f='${Version}' nemoclaw-python3.13-htmlparser-fix)" = "3.13.5-2+deb13u4+nemoclaw1" \
&& test "$(dpkg-query -W -f='${Version}' nemoclaw-python3.13-htmlparser-fix)" = "3.13.5-2+deb13u5+nemoclaw1" \
&& test "$(jq --version)" = "jq-1.8.2" \
&& ldd /usr/bin/jq | grep -Eq 'libonig[.]so[.]5' \
&& printf '%s\n' '{"sandbox":"healthy"}' | jq -e '.sandbox == "healthy"' >/dev/null \
Expand Down Expand Up @@ -226,7 +226,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
"vim-tiny=2:9.2.0858-1" \
"libssh2-1t64=1.11.1-1+deb13u1+nemoclaw2" \
"libssl3t64=3.5.7-1~deb13u2" \
"nemoclaw-python3.13-htmlparser-fix=3.13.5-2+deb13u4+nemoclaw1" \
"nemoclaw-python3.13-htmlparser-fix=3.13.5-2+deb13u5+nemoclaw1" \
"perl-base=5.44.0-1nemoclaw1" \
"perl=5.44.0-1nemoclaw1" \
> /usr/local/share/nemoclaw/security-packages.txt \
Expand Down
4 changes: 2 additions & 2 deletions agents/pi/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -276,7 +276,7 @@ RUN set -eu; \
"vim-tiny=2:9.2.0858-1" \
"libssh2-1t64=1.11.1-1+deb13u1+nemoclaw2" \
"libssl3t64=3.5.7-1~deb13u2" \
"nemoclaw-python3.13-htmlparser-fix=3.13.5-2+deb13u4+nemoclaw1" \
"nemoclaw-python3.13-htmlparser-fix=3.13.5-2+deb13u5+nemoclaw1" \
"perl-base=5.44.0-1nemoclaw1" \
"perl=5.44.0-1nemoclaw1" \
| cmp -s - "$security_inventory"; \
Expand All @@ -288,7 +288,7 @@ RUN set -eu; \
test "$(dpkg-query -W -f='${Version}' vim-tiny)" = "2:9.2.0858-1"; \
test "$(dpkg-query -W -f='${Version}' libssh2-1t64)" = "1.11.1-1+deb13u1+nemoclaw2"; \
test "$(dpkg-query -W -f='${Version}' libssl3t64)" = "3.5.7-1~deb13u2"; \
test "$(dpkg-query -W -f='${Version}' nemoclaw-python3.13-htmlparser-fix)" = "3.13.5-2+deb13u4+nemoclaw1"; \
test "$(dpkg-query -W -f='${Version}' nemoclaw-python3.13-htmlparser-fix)" = "3.13.5-2+deb13u5+nemoclaw1"; \
test "$(dpkg-query -W -f='${Version}' perl-base)" = "5.44.0-1nemoclaw1"; \
test "$(dpkg-query -W -f='${Version}' perl)" = "5.44.0-1nemoclaw1"; \
test "$(perl -e 'print $^V')" = "v5.44.0"; \
Expand Down
12 changes: 6 additions & 6 deletions agents/pi/Dockerfile.base
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@ ARG NEMOCLAW_CORPORATE_CA_B64
RUN apt-get update && apt-get install -y --no-install-recommends \
build-essential=12.12 \
ca-certificates=20250419 \
curl=8.14.1-2+deb13u4 \
curl=8.14.1-2+deb13u5 \
git=1:2.47.3-0+deb13u1 \
libssl-dev=3.5.7-1~deb13u2 \
openssh-server=1:10.0p1-7+deb13u4 \
Expand Down Expand Up @@ -91,17 +91,17 @@ ENV DEBIAN_FRONTEND=noninteractive \
# hadolint ignore=DL3001,DL4006
RUN apt-get update && apt-get install -y --no-install-recommends \
python3=3.13.5-1 \
curl=8.14.1-2+deb13u4 \
curl=8.14.1-2+deb13u5 \
git=1:2.47.3-0+deb13u1 \
ca-certificates=20250419 \
iproute2=6.15.0-1 \
iptables=1.8.11-2 \
nftables=1.1.3-1 \
libcap2-bin=1:2.75-10+deb13u1+b1 \
libcap2-bin=1:2.75-10+deb13u1+b3 \
libssl3t64=3.5.7-1~deb13u2 \
util-linux=2.41-5 \
procps=2:4.0.4-9 \
e2fsprogs=1.47.2-3+b11 \
e2fsprogs=1.47.2-3+b12 \
"dos2unix=7.5.2-1*" \
openssh-sftp-server=1:10.0p1-7+deb13u4 \
ripgrep=14.1.1-1+b4 \
Expand Down Expand Up @@ -195,7 +195,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
&& test "$(dpkg-query -W -f='${Version}' vim-tiny)" = "2:9.2.0858-1" \
&& test "$(dpkg-query -W -f='${Version}' libssh2-1t64)" = "1.11.1-1+deb13u1+nemoclaw2" \
&& test "$(dpkg-query -W -f='${Version}' libssl3t64)" = "3.5.7-1~deb13u2" \
&& test "$(dpkg-query -W -f='${Version}' nemoclaw-python3.13-htmlparser-fix)" = "3.13.5-2+deb13u4+nemoclaw1" \
&& test "$(dpkg-query -W -f='${Version}' nemoclaw-python3.13-htmlparser-fix)" = "3.13.5-2+deb13u5+nemoclaw1" \
&& test "$(jq --version)" = "jq-1.8.2" \
&& ldd /usr/bin/jq | grep -Eq 'libonig[.]so[.]5' \
&& printf '%s\n' '{"sandbox":"healthy"}' | jq -e '.sandbox == "healthy"' >/dev/null \
Expand Down Expand Up @@ -230,7 +230,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
"vim-tiny=2:9.2.0858-1" \
"libssh2-1t64=1.11.1-1+deb13u1+nemoclaw2" \
"libssl3t64=3.5.7-1~deb13u2" \
"nemoclaw-python3.13-htmlparser-fix=3.13.5-2+deb13u4+nemoclaw1" \
"nemoclaw-python3.13-htmlparser-fix=3.13.5-2+deb13u5+nemoclaw1" \
"perl-base=5.44.0-1nemoclaw1" \
"perl=5.44.0-1nemoclaw1" \
> /usr/local/share/nemoclaw/security-packages.txt \
Expand Down
2 changes: 1 addition & 1 deletion ci/platform-matrix.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -203,7 +203,7 @@
{
"name": "Sandboxed execution",
"status": "caveated",
"notes": "Landlock, seccomp, network namespace isolation, no-new-privileges, privilege dropping, and process limits (nproc 512 at `scripts/lib/sandbox-rlimits.sh:8`) are tested and on by default. The `DANGEROUS_CAPS` list at `scripts/lib/sandbox-init.sh:275-286` drops cap_sys_admin, cap_sys_ptrace, cap_net_raw, cap_dac_override, cap_sys_chroot, cap_fsetid, cap_setfcap, cap_mknod, cap_audit_write, cap_net_bind_service with `capsh --drop` when CAP_SETPCAP is present. Limitation (active issue #3280): the fail-closed bounding-set gate is opt-in via `NEMOCLAW_REQUIRE_CAP_DROP=1`; the default is warn-and-continue so hosts without CAP_SETPCAP still boot, which means dangerous caps can remain in the bounding set on some hosts even though the effective set is empty."
"notes": "Landlock, seccomp, network namespace isolation, no-new-privileges, privilege dropping, and process limits (nproc 512 at `scripts/lib/sandbox-rlimits.sh:8`) are tested and on by default. Under full enforcement, OpenShell clears the child bounding set. OpenClaw and Hermes skip duplicate capability dropping only after observing five empty capability sets in the calling process. Other states retain the `DANGEROUS_CAPS` list and one `capsh` attempt in `scripts/lib/sandbox-init.sh`. Limitation (active issue #3280): `NEMOCLAW_REQUIRE_CAP_DROP=1` requires verification of the listed dangerous bounding capabilities; it does not require all five sets to be empty. Without strict mode, the fallback warns and continues when dangerous bounding capabilities remain or cannot be verified."
},
{
"name": "Routed inference",
Expand Down
Loading