SecuritySecurity Controls

Understand Filesystem Controls

View as Markdown

NemoClaw uses OpenShell filesystem policy to restrict access outside the writable agent state tree.

OpenShell covers additional filesystem enforcement details, including hard_requirement compatibility mode for Landlock and policy path validation rules. Refer to the Filesystem Controls section of the OpenShell Security Best Practices.

Read-Only System Paths

The container mounts system directories read-only to prevent the agent from modifying binaries, libraries, or configuration files.

AspectDetail
Default/usr, /lib, /proc, /dev/urandom, /app, /etc, /var/log, and /var/lib/dpkg are read-only.
What you can changeAdd or remove paths in the filesystem_policy.read_only section of the policy file.
Risk if relaxedMaking /usr or /lib writable lets the agent replace system binaries (such as curl or node) with trojanized versions. Making /etc writable lets the agent modify DNS resolution, TLS trust stores, or user accounts.
RecommendationNever make system paths writable. If the agent needs a writable location for generated files, use a subdirectory of /sandbox.

Agent Config Directory

The /sandbox/.hermes directory contains Hermes runtime configuration, generated environment settings, logs, platform state, and durable database state. NemoClaw writes config.yaml and .env during onboarding and rebuilds. Direct edits to these files can be overwritten when NemoClaw regenerates the image.

Hermes also stores runtime state such as state.db, logs, and platform sessions under the .hermes tree. Messaging sessions such as WhatsApp pairing can remain mutable by design so they survive rebuilds.

The Hermes config and state tree remains mutable after provisioning. NemoClaw does not prevent the sandbox identity from changing paths that its Unix permissions allow. Hermes startup and restart adopt a stable config snapshot after validating its paths and secret boundary. The native mcp_servers map in that snapshot is authoritative, including direct edits; there is no separate host-side MCP registry comparison.

AspectDetail
DefaultThe Hermes config tree contains NemoClaw-generated config plus mutable runtime state.
What you can changeHermes and the sandbox user can change mutable runtime config. Use host-side NemoClaw commands when you also need OpenShell policy and provider updates.
Risk of direct editsInvalid config can prevent Hermes from starting. A direct MCP edit cannot by itself create the matching OpenShell policy or credential binding.
RecommendationKeep credentials in OpenShell providers. Back up Hermes state before destructive operations.

Writable Paths

The agent has read-write access to /sandbox, /tmp, /dev/null, and /dev/pts.

AspectDetail
Default/sandbox (agent workspace), /tmp (temporary files), /dev/null, and /dev/pts (the devpts pseudo-terminal directory, required so PTY-based tools such as tmux, script, and interactive shells can allocate a terminal).
What you can changeAdd additional writable paths in filesystem_policy.read_write.
Risk if relaxedEach additional writable path expands the agent’s ability to persist data and potentially modify system behavior. Adding /var lets the agent write to log directories. Adding /home gives access to other user directories.
RecommendationKeep writable paths to /sandbox and /tmp. If the agent needs a persistent working directory, create a subdirectory under /sandbox.

Landlock LSM Enforcement

Landlock is a Linux Security Module that enforces filesystem access rules at the kernel level.

AspectDetail
Defaultcompatibility: best_effort. The entrypoint applies Landlock rules when the kernel supports them and silently skips them on older kernels.
What you can changeThis is a NemoClaw default, not a user-facing knob.
Risk if relaxedOn kernels without Landlock support (pre-5.13), filesystem restrictions rely solely on container mount configuration, which is less granular.
RecommendationRun on a kernel that supports Landlock (5.13+). Ubuntu 22.04 LTS and later include Landlock support.