fix(openclaw): isolate startup guard output

scripts/nemoclaw-start.sh

@@ -5344,8 +5344,9 @@ run_openclaw_config_guard() {
     # child. A `timeout` wrapper or command substitution would become Python's
     # parent and invalidate that identity, so capture through a root-private
     # file while invoking Python directly.
-    install -d -o root -g root -m 700 /run/nemoclaw || return 1
-    output_file="/run/nemoclaw/.openclaw-config-guard.$$.output"
+    install -d -o root -g root -m 755 /run/nemoclaw || return 1
+    install -d -o root -g root -m 700 /run/nemoclaw/openclaw-config-guard || return 1
+    output_file="/run/nemoclaw/openclaw-config-guard/.$$.output"
     : >"$output_file"
     chmod 600 "$output_file"
     rc=0

test/nemoclaw-start-perms.test.ts

@@ -28,9 +28,10 @@ function extractShellFunction(name: string): string {
   return `${name}() {${body}\n}`;
 }
 
-function runBash(script: string) {
+function runBash(script: string, env: NodeJS.ProcessEnv = process.env) {
   return spawnSync("bash", ["-c", script], {
     encoding: "utf-8",
+    env,
     timeout: 10_000,
   });
 }
@@ -47,6 +48,143 @@ function replaceRequired(source: string, target: string, replacement: string): s
 
 const oneShotFunction = extractShellFunction("run_oneshot_command");
 const resolveNormalizerFunction = extractShellFunction("resolve_mutable_config_normalizer");
+const configGuardFunction = extractShellFunction("run_openclaw_config_guard");
+const canRunPrivilegedPermissionFixture =
+  process.platform === "linux" &&
+  spawnSync("sudo", ["-n", "test", "-x", "/usr/bin/setpriv"], { stdio: "ignore" }).status === 0;
+
+function useTestRuntimeDirectory(source: string): string {
+  let result = replaceRequired(
+    source,
+    " /run/nemoclaw || return 1",
+    ' "$NEMOCLAW_TEST_RUNTIME_DIR" || return 1',
+  );
+  result = replaceRequired(
+    result,
+    " /run/nemoclaw/openclaw-config-guard || return 1",
+    ' "$NEMOCLAW_TEST_RUNTIME_DIR/openclaw-config-guard" || return 1',
+  );
+  return replaceRequired(
+    result,
+    'output_file="/run/nemoclaw/openclaw-config-guard/.$$.output"',
+    'output_file="$NEMOCLAW_TEST_RUNTIME_DIR/openclaw-config-guard/.$$.output"',
+  );
+}
+
+describe("nemoclaw-start config guard output permissions", () => {
+  it("keeps the shared runtime path traversable while startup-owner output stays private (#9357)", () => {
+    const root = fs.mkdtempSync(path.join(os.tmpdir(), "nemoclaw-config-guard-output-"));
+    const runtimeDir = path.join(root, "nemoclaw");
+    const privateDir = path.join(runtimeDir, "openclaw-config-guard");
+    const caBundle = path.join(runtimeDir, "managed-startup-ca-bundle.pem");
+    const observedOutput = path.join(root, "observed-output");
+    fs.mkdirSync(runtimeDir, { mode: 0o700 });
+    fs.writeFileSync(caBundle, "corporate CA\n", { mode: 0o444 });
+
+    const testFunction = useTestRuntimeDirectory(
+      configGuardFunction.replaceAll("install -d -o root -g root -m", "install -d -m"),
+    );
+    const script = [
+      "set -euo pipefail",
+      "python3() { find \"$NEMOCLAW_TEST_RUNTIME_DIR\" -type f -name '.*.output' -print >\"$NEMOCLAW_TEST_OBSERVED_OUTPUT\"; printf 'private guard output\\n'; }",
+      "_OPENCLAW_CONFIG_GUARD=/tmp/openclaw-config-guard.py",
+      testFunction,
+      "run_openclaw_config_guard publish-startup-ready --startup-owner",
+    ].join("\n");
+
+    try {
+      const result = runBash(script, {
+        ...process.env,
+        NEMOCLAW_TEST_OBSERVED_OUTPUT: observedOutput,
+        NEMOCLAW_TEST_RUNTIME_DIR: runtimeDir,
+      });
+      expect(result.status, result.stderr).toBe(0);
+      expect(mode(runtimeDir)).toBe(0o755);
+      expect(fs.readFileSync(caBundle, "utf-8")).toBe("corporate CA\n");
+      expect(mode(privateDir)).toBe(0o700);
+      const outputPath = fs.readFileSync(observedOutput, "utf-8").trim();
+      expect(path.dirname(outputPath)).toBe(privateDir);
+      expect(path.basename(outputPath)).toMatch(/^\.\d+\.output$/);
+      expect(fs.readdirSync(privateDir)).toEqual([]);
+    } finally {
+      fs.rmSync(root, { recursive: true, force: true });
+    }
+  });
+
+  it.runIf(canRunPrivilegedPermissionFixture)(
+    "keeps the CA readable while denying a distinct unprivileged user access to live guard output (#9357)",
+    () => {
+      const root = fs.mkdtempSync(path.join(os.tmpdir(), "nemoclaw-config-guard-root-output-"));
+      const runtimeDir = path.join(root, "nemoclaw");
+      const privateDir = path.join(runtimeDir, "openclaw-config-guard");
+      const caBundle = path.join(runtimeDir, "managed-startup-ca-bundle.pem");
+      const observedAccess = path.join(root, "observed-access");
+      const nobodyUid = spawnSync("id", ["-u", "nobody"], { encoding: "utf-8" }).stdout.trim();
+      const nobodyGid = spawnSync("id", ["-g", "nobody"], { encoding: "utf-8" }).stdout.trim();
+      fs.chmodSync(root, 0o755);
+      fs.mkdirSync(runtimeDir, { mode: 0o700 });
+      fs.writeFileSync(caBundle, "corporate CA\n", { mode: 0o444 });
+
+      const testFunction = useTestRuntimeDirectory(configGuardFunction);
+      const script = [
+        "set -euo pipefail",
+        "python3() {",
+        '  local output_path=""',
+        '  output_path="$(find "$NEMOCLAW_TEST_PRIVATE_DIR" -maxdepth 1 -type f -name \'.*.output\' -print -quit)"',
+        '  test -n "$output_path"',
+        '  /usr/bin/setpriv --reuid="$NEMOCLAW_TEST_NOBODY_UID" --regid="$NEMOCLAW_TEST_NOBODY_GID" --clear-groups -- sh -eu -c \'test ! -r "$1"; ! ls -A "$2" >/dev/null 2>&1; grep -Fqx "corporate CA" "$3"\' sh "$output_path" "$NEMOCLAW_TEST_PRIVATE_DIR" "$NEMOCLAW_TEST_CA_BUNDLE"',
+        "  printf 'denied\\n' >\"$NEMOCLAW_TEST_OBSERVED_ACCESS\"",
+        "  printf 'private guard output\\n'",
+        "}",
+        'chown root:root "$NEMOCLAW_TEST_CA_BUNDLE"',
+        "_OPENCLAW_CONFIG_GUARD=/tmp/openclaw-config-guard.py",
+        testFunction,
+        "run_openclaw_config_guard publish-startup-ready --startup-owner",
+      ].join("\n");
+
+      try {
+        const result = spawnSync(
+          "sudo",
+          [
+            "-n",
+            "env",
+            `PATH=${process.env.PATH ?? "/usr/bin:/bin"}`,
+            `NEMOCLAW_TEST_CA_BUNDLE=${caBundle}`,
+            `NEMOCLAW_TEST_NOBODY_GID=${nobodyGid}`,
+            `NEMOCLAW_TEST_NOBODY_UID=${nobodyUid}`,
+            `NEMOCLAW_TEST_OBSERVED_ACCESS=${observedAccess}`,
+            `NEMOCLAW_TEST_PRIVATE_DIR=${privateDir}`,
+            `NEMOCLAW_TEST_RUNTIME_DIR=${runtimeDir}`,
+            "bash",
+            "-c",
+            script,
+          ],
+          { encoding: "utf-8", timeout: 10_000 },
+        );
+        expect(result.status, result.stderr).toBe(0);
+        expect(fs.readFileSync(observedAccess, "utf-8")).toBe("denied\n");
+        expect(mode(runtimeDir)).toBe(0o755);
+        expect(fs.statSync(runtimeDir).uid).toBe(0);
+        expect(mode(caBundle)).toBe(0o444);
+        expect(fs.statSync(caBundle).uid).toBe(0);
+        expect(mode(privateDir)).toBe(0o700);
+        expect(fs.statSync(privateDir).uid).toBe(0);
+        const remainingOutput = spawnSync(
+          "sudo",
+          ["-n", "/usr/bin/find", privateDir, "-mindepth", "1", "-maxdepth", "1", "-print", "-quit"],
+          { encoding: "utf-8" },
+        );
+        expect(remainingOutput.status, remainingOutput.stderr).toBe(0);
+        expect(remainingOutput.stdout).toBe("");
+      } finally {
+        const cleanup = spawnSync("sudo", ["-n", "/usr/bin/rm", "-rf", "--", root], {
+          encoding: "utf-8",
+        });
+        expect(cleanup.status, cleanup.stderr).toBe(0);
+      }
+    },
+  );
+});
 
 describe("nemoclaw-start one-shot command lifecycle", () => {
   it("sources the trusted runtime env before preserving one-shot argv (#4504)", () => {