From e92e414872409772fca4ccb4dda2713b91f433a9 Mon Sep 17 00:00:00 2001 From: Aaron Erickson Date: Thu, 9 Apr 2026 12:07:12 -0700 Subject: [PATCH] fix(security): remove pre-allowed messaging endpoints from base sandbox policy Telegram and Discord were pre-allowed in the base network policy, giving every sandboxed agent default access to external messaging APIs without user opt-in. Move these to opt-in only via the existing preset system, which is already applied automatically during onboarding when users configure messaging tokens. Signed-off-by: Aaron Erickson --- .../references/network-policies.md | 5 -- docs/reference/network-policies.md | 5 -- .../policies/openclaw-sandbox.yaml | 46 ------------------- 3 files changed, 56 deletions(-) diff --git a/.agents/skills/nemoclaw-user-reference/references/network-policies.md b/.agents/skills/nemoclaw-user-reference/references/network-policies.md index 39706dd9861..06048bb1df7 100644 --- a/.agents/skills/nemoclaw-user-reference/references/network-policies.md +++ b/.agents/skills/nemoclaw-user-reference/references/network-policies.md @@ -73,11 +73,6 @@ The following endpoint groups are allowed by default: - `/usr/local/bin/openclaw`, `/usr/local/bin/npm`, `/usr/local/bin/node` - All methods, all paths -* - `telegram` - - `api.telegram.org:443` - - Any binary - - GET, POST on `/bot*/**` - ::: All endpoints use TLS termination and are enforced at port 443. diff --git a/docs/reference/network-policies.md b/docs/reference/network-policies.md index 68c052686b9..ac099309a50 100644 --- a/docs/reference/network-policies.md +++ b/docs/reference/network-policies.md @@ -93,11 +93,6 @@ The following endpoint groups are allowed by default: - `/usr/local/bin/openclaw`, `/usr/local/bin/npm`, `/usr/local/bin/node` - All methods, all paths -* - `telegram` - - `api.telegram.org:443` - - Any binary - - GET, POST on `/bot*/**` - ::: All endpoints use TLS termination and are enforced at port 443. diff --git a/nemoclaw-blueprint/policies/openclaw-sandbox.yaml b/nemoclaw-blueprint/policies/openclaw-sandbox.yaml index d9ba1597863..7f53a25df4c 100644 --- a/nemoclaw-blueprint/policies/openclaw-sandbox.yaml +++ b/nemoclaw-blueprint/policies/openclaw-sandbox.yaml @@ -207,49 +207,3 @@ network_policies: - { path: /usr/local/bin/openclaw } - { path: /usr/local/bin/npm } - { path: /usr/local/bin/node } - - # ── Messaging — pre-allowed for OpenClaw agent notifications ──── - # Restricted to node processes to prevent arbitrary data exfiltration - # via curl, wget, python, etc. (See: #272) - telegram: - name: telegram - endpoints: - - host: api.telegram.org - port: 443 - protocol: rest - enforcement: enforce - tls: terminate - rules: - - allow: { method: GET, path: "/bot*/**" } - - allow: { method: POST, path: "/bot*/**" } - - allow: { method: GET, path: "/file/bot*/**" } - binaries: - - { path: /usr/local/bin/node } - - discord: - name: discord - endpoints: - - host: discord.com - port: 443 - protocol: rest - enforcement: enforce - tls: terminate - rules: - - allow: { method: GET, path: "/**" } - - allow: { method: POST, path: "/**" } - # WebSocket gateway — must use access: full (CONNECT tunnel) instead - # of protocol: rest. The proxy's HTTP idle timeout (~2 min) kills - # long-lived WebSocket connections; a CONNECT tunnel avoids - # HTTP-level timeouts entirely. Matches presets/discord.yaml. See #409. - - host: gateway.discord.gg - port: 443 - access: full - - host: cdn.discordapp.com - port: 443 - protocol: rest - enforcement: enforce - tls: terminate - rules: - - allow: { method: GET, path: "/**" } - binaries: - - { path: /usr/local/bin/node }