> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.nvidia.com/nemoclaw/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.nvidia.com/nemoclaw/_mcp/server.

# Understand Filesystem Controls

> Review NemoClaw filesystem defaults, writable paths, agent state protections, and Landlock enforcement.

NemoClaw restricts which paths the agent can read and write, protecting system binaries, configuration files, and gateway credentials.

OpenShell covers additional filesystem enforcement details, including `hard_requirement` compatibility mode for Landlock and policy path validation rules.
Refer to the [Filesystem Controls](https://docs.nvidia.com/openshell/latest/security/best-practices.html#filesystem-controls) section of the OpenShell Security Best Practices.

## Read-Only System Paths

The container mounts system directories read-only to prevent the agent from modifying binaries, libraries, or configuration files.

| Aspect              | Detail                                                                                                                                                                                                                        |
| ------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Default             | `/usr`, `/lib`, `/proc`, `/dev/urandom`, `/app`, `/etc`, `/var/log`, and `/var/lib/dpkg` are read-only.                                                                                                                       |
| What you can change | Add or remove paths in the `filesystem_policy.read_only` section of the policy file.                                                                                                                                          |
| Risk if relaxed     | Making `/usr` or `/lib` writable lets the agent replace system binaries (such as `curl` or `node`) with trojanized versions. Making `/etc` writable lets the agent modify DNS resolution, TLS trust stores, or user accounts. |
| Recommendation      | Never make system paths writable. If the agent needs a writable location for generated files, use a subdirectory of `/sandbox`.                                                                                               |

## Agent Config Directory

The `/sandbox/.hermes` directory contains Hermes runtime configuration, generated environment settings, logs, platform state, and durable database state.
NemoClaw writes `config.yaml` and `.env` during onboarding and rebuilds.
Direct edits to these files can be overwritten when NemoClaw regenerates the image.

Hermes also stores runtime state such as `state.db`, logs, and platform sessions under the `.hermes` tree.
Messaging sessions such as WhatsApp pairing can remain mutable by design so they survive rebuilds.

For plan-aware current images, the Shields workflow derives the Hermes lock plan from its agent manifest.
Historical Hermes images that have a bundled helper but no generated plan use the helper's reviewed legacy inventory until the sandbox is rebuilt.

It locks `cron`, `hooks`, `platforms`, `plugins`, `profiles`, `skills`, `skins`, `weixin`, and `workspace` to `root:sandbox`.
The `profiles/dashboard-home` carve-out remains `sandbox:sandbox 0700`, and the guard does not traverse or rewrite its descendants.
It locks the `pairing` confidentiality root to `root:sandbox 0710`.
Hermes runtime directories without a Shields declaration remain mutable.

The shared state-directory guard applies the manifest declaration to `pairing` on current Hermes images.
On historical images, the reviewed legacy inventory also treats present `credentials` and `identity` directories as confidentiality roots.

The guard sets the root to `root:sandbox 0710`, keeps it traversable but unlistable to the sandbox group, and sets every descendant to `root:root` with no group or world permission bits.
As a result, a known-name probe for a missing direct child returns `ENOENT`, while directory listing, nested traversal, and protected-file reads return `EACCES`.

| Aspect               | Detail                                                                                                                                 |
| -------------------- | -------------------------------------------------------------------------------------------------------------------------------------- |
| Default              | The Hermes config tree contains NemoClaw-generated config plus mutable runtime state.                                                  |
| What you can change  | Use host-side NemoClaw commands for durable model, provider, messaging, and policy changes; inspect files directly only for debugging. |
| Risk of direct edits | Direct edits to generated config can drift from the host registry and may be lost on rebuild.                                          |
| Recommendation       | For sensitive workloads, keep generated config under NemoClaw control and back up Hermes state before destructive operations.          |

## Writable Paths

The agent has read-write access to `/sandbox`, `/tmp`, `/dev/null`, and `/dev/pts`.

| Aspect              | Detail                                                                                                                                                                                                                            |
| ------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Default             | `/sandbox` (agent workspace), `/tmp` (temporary files), `/dev/null`, and `/dev/pts` (the devpts pseudo-terminal directory, required so PTY-based tools such as `tmux`, `script`, and interactive shells can allocate a terminal). |
| What you can change | Add additional writable paths in `filesystem_policy.read_write`.                                                                                                                                                                  |
| Risk if relaxed     | Each additional writable path expands the agent's ability to persist data and potentially modify system behavior. Adding `/var` lets the agent write to log directories. Adding `/home` gives access to other user directories.   |
| Recommendation      | Keep writable paths to `/sandbox` and `/tmp`. If the agent needs a persistent working directory, create a subdirectory under `/sandbox`.                                                                                          |

## Landlock LSM Enforcement

Landlock is a Linux Security Module that enforces filesystem access rules at the kernel level.

| Aspect              | Detail                                                                                                                                        |
| ------------------- | --------------------------------------------------------------------------------------------------------------------------------------------- |
| Default             | `compatibility: best_effort`. The entrypoint applies Landlock rules when the kernel supports them and silently skips them on older kernels.   |
| What you can change | This is a NemoClaw default, not a user-facing knob.                                                                                           |
| Risk if relaxed     | On kernels without Landlock support (pre-5.13), filesystem restrictions rely solely on container mount configuration, which is less granular. |
| Recommendation      | Run on a kernel that supports Landlock (5.13+). Ubuntu 22.04 LTS and later include Landlock support.                                          |