feat(security): Add Phase 1 security features
* test: add comprehensive recovery tests for agent loop Add recovery test coverage for all edge cases and failure scenarios in the agentic loop, addressing the missing test coverage for recovery use cases. Tool Call Parsing Edge Cases: - Empty tool_result tags - Empty tool_calls arrays - Whitespace-only tool names - Empty string arguments History Management: - Trimming without system prompt - Role ordering consistency after trim - Only system prompt edge case Arguments Parsing: - Invalid JSON string fallback - None arguments handling - Null value handling JSON Extraction: - Empty input handling - Whitespace only input - Multiple JSON objects - JSON arrays Tool Call Value Parsing: - Missing name field - Non-OpenAI format - Empty tool_calls array - Missing tool_calls field fallback - Top-level array format Constants Validation: - MAX_TOOL_ITERATIONS bounds (prevent runaway loops) - MAX_HISTORY_MESSAGES bounds (prevent memory bloat) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * feat(security): Add Phase 1 security features - sandboxing, resource limits, audit logging Phase 1 security enhancements with zero impact on the quick setup wizard: - ✅ Pluggable sandbox trait system (traits.rs) - ✅ Landlock sandbox support (Linux kernel 5.13+) - ✅ Firejail sandbox support (Linux user-space) - ✅ Bubblewrap sandbox support (Linux/macOS user namespaces) - ✅ Docker sandbox support (container isolation) - ✅ No-op fallback (application-layer security only) - ✅ Auto-detection logic (detect.rs) - ✅ Audit logging with HMAC signing support (audit.rs) - ✅ SecurityConfig schema (SandboxConfig, ResourceLimitsConfig, AuditConfig) - ✅ Feature-gated implementation (sandbox-landlock, sandbox-bubblewrap) - ✅ 1,265 tests passing Key design principles: - Silent auto-detection: no new prompts in wizard - Graceful degradation: works on all platforms - Feature flags: zero overhead when disabled - Pluggable architecture: swap sandbox backends via config - Backward compatible: existing configs work unchanged Config usage: ```toml [security.sandbox] enabled = false # Explicitly disable backend = "auto" # auto, landlock, firejail, bubblewrap, docker, none [security.resources] max_memory_mb = 512 max_cpu_time_seconds = 60 [security.audit] enabled = true log_path = "audit.log" sign_events = false ``` Security documentation: - docs/sandboxing.md: Sandbox implementation strategies - docs/resource-limits.md: Resource limit approaches - docs/audit-logging.md: Audit logging specification - docs/security-roadmap.md: 3-phase implementation plan - docs/frictionless-security.md: Zero-impact wizard design - docs/agnostic-security.md: Platform/hardware agnostic approach Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Argenis
GitHub
parent
1140a7887d
commit
0383a82a6f
22 changed files with 4129 additions and 13 deletions
348
docs/agnostic-security.md
Normal file
348
docs/agnostic-security.md
Normal file
|
|
@ -0,0 +1,348 @@
|
|||
# Agnostic Security: Zero Impact on Portability
|
||||
|
||||
## Core Question: Will security features break...
|
||||
1. ❓ Fast cross-compilation builds?
|
||||
2. ❓ Pluggable architecture (swap anything)?
|
||||
3. ❓ Hardware agnosticism (ARM, x86, RISC-V)?
|
||||
4. ❓ Small hardware support (<5MB RAM, $10 boards)?
|
||||
|
||||
**Answer: NO to all** — Security is designed as **optional feature flags** with **platform-specific conditional compilation**.
|
||||
|
||||
---
|
||||
|
||||
## 1. Build Speed: Feature-Gated Security
|
||||
|
||||
### Cargo.toml: Security Features Behind Features
|
||||
|
||||
```toml
|
||||
[features]
|
||||
default = ["basic-security"]
|
||||
|
||||
# Basic security (always on, zero overhead)
|
||||
basic-security = []
|
||||
|
||||
# Platform-specific sandboxing (opt-in per platform)
|
||||
sandbox-landlock = [] # Linux only
|
||||
sandbox-firejail = [] # Linux only
|
||||
sandbox-bubblewrap = []# macOS/Linux
|
||||
sandbox-docker = [] # All platforms (heavy)
|
||||
|
||||
# Full security suite (for production builds)
|
||||
security-full = [
|
||||
"basic-security",
|
||||
"sandbox-landlock",
|
||||
"resource-monitoring",
|
||||
"audit-logging",
|
||||
]
|
||||
|
||||
# Resource & audit monitoring
|
||||
resource-monitoring = []
|
||||
audit-logging = []
|
||||
|
||||
# Development builds (fastest, no extra deps)
|
||||
dev = []
|
||||
```
|
||||
|
||||
### Build Commands (Choose Your Profile)
|
||||
|
||||
```bash
|
||||
# Ultra-fast dev build (no security extras)
|
||||
cargo build --profile dev
|
||||
|
||||
# Release build with basic security (default)
|
||||
cargo build --release
|
||||
# → Includes: allowlist, path blocking, injection protection
|
||||
# → Excludes: Landlock, Firejail, audit logging
|
||||
|
||||
# Production build with full security
|
||||
cargo build --release --features security-full
|
||||
# → Includes: Everything
|
||||
|
||||
# Platform-specific sandbox only
|
||||
cargo build --release --features sandbox-landlock # Linux
|
||||
cargo build --release --features sandbox-docker # All platforms
|
||||
```
|
||||
|
||||
### Conditional Compilation: Zero Overhead When Disabled
|
||||
|
||||
```rust
|
||||
// src/security/mod.rs
|
||||
|
||||
#[cfg(feature = "sandbox-landlock")]
|
||||
mod landlock;
|
||||
#[cfg(feature = "sandbox-landlock")]
|
||||
pub use landlock::LandlockSandbox;
|
||||
|
||||
#[cfg(feature = "sandbox-firejail")]
|
||||
mod firejail;
|
||||
#[cfg(feature = "sandbox-firejail")]
|
||||
pub use firejail::FirejailSandbox;
|
||||
|
||||
// Always-include basic security (no feature flag)
|
||||
pub mod policy; // allowlist, path blocking, injection protection
|
||||
```
|
||||
|
||||
**Result**: When features are disabled, the code isn't even compiled — **zero binary bloat**.
|
||||
|
||||
---
|
||||
|
||||
## 2. Pluggable Architecture: Security Is a Trait Too
|
||||
|
||||
### Security Backend Trait (Swappable Like Everything Else)
|
||||
|
||||
```rust
|
||||
// src/security/traits.rs
|
||||
|
||||
#[async_trait]
|
||||
pub trait Sandbox: Send + Sync {
|
||||
/// Wrap a command with sandbox protection
|
||||
fn wrap_command(&self, cmd: &mut std::process::Command) -> std::io::Result<()>;
|
||||
|
||||
/// Check if sandbox is available on this platform
|
||||
fn is_available(&self) -> bool;
|
||||
|
||||
/// Human-readable name
|
||||
fn name(&self) -> &str;
|
||||
}
|
||||
|
||||
// No-op sandbox (always available)
|
||||
pub struct NoopSandbox;
|
||||
|
||||
impl Sandbox for NoopSandbox {
|
||||
fn wrap_command(&self, _cmd: &mut std::process::Command) -> std::io::Result<()> {
|
||||
Ok(()) // Pass through unchanged
|
||||
}
|
||||
|
||||
fn is_available(&self) -> bool { true }
|
||||
fn name(&self) -> &str { "none" }
|
||||
}
|
||||
```
|
||||
|
||||
### Factory Pattern: Auto-Select Based on Features
|
||||
|
||||
```rust
|
||||
// src/security/factory.rs
|
||||
|
||||
pub fn create_sandbox() -> Box<dyn Sandbox> {
|
||||
#[cfg(feature = "sandbox-landlock")]
|
||||
{
|
||||
if LandlockSandbox::is_available() {
|
||||
return Box::new(LandlockSandbox::new());
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(feature = "sandbox-firejail")]
|
||||
{
|
||||
if FirejailSandbox::is_available() {
|
||||
return Box::new(FirejailSandbox::new());
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(feature = "sandbox-bubblewrap")]
|
||||
{
|
||||
if BubblewrapSandbox::is_available() {
|
||||
return Box::new(BubblewrapSandbox::new());
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(feature = "sandbox-docker")]
|
||||
{
|
||||
if DockerSandbox::is_available() {
|
||||
return Box::new(DockerSandbox::new());
|
||||
}
|
||||
}
|
||||
|
||||
// Fallback: always available
|
||||
Box::new(NoopSandbox)
|
||||
}
|
||||
```
|
||||
|
||||
**Just like providers, channels, and memory — security is pluggable!**
|
||||
|
||||
---
|
||||
|
||||
## 3. Hardware Agnosticism: Same Binary, Different Platforms
|
||||
|
||||
### Cross-Platform Behavior Matrix
|
||||
|
||||
| Platform | Builds On | Runtime Behavior |
|
||||
|----------|-----------|------------------|
|
||||
| **Linux ARM** (Raspberry Pi) | ✅ Yes | Landlock → None (graceful) |
|
||||
| **Linux x86_64** | ✅ Yes | Landlock → Firejail → None |
|
||||
| **macOS ARM** (M1/M2) | ✅ Yes | Bubblewrap → None |
|
||||
| **macOS x86_64** | ✅ Yes | Bubblewrap → None |
|
||||
| **Windows ARM** | ✅ Yes | None (app-layer) |
|
||||
| **Windows x86_64** | ✅ Yes | None (app-layer) |
|
||||
| **RISC-V Linux** | ✅ Yes | Landlock → None |
|
||||
|
||||
### How It Works: Runtime Detection
|
||||
|
||||
```rust
|
||||
// src/security/detect.rs
|
||||
|
||||
impl SandboxingStrategy {
|
||||
/// Choose best available sandbox AT RUNTIME
|
||||
pub fn detect() -> SandboxingStrategy {
|
||||
#[cfg(target_os = "linux")]
|
||||
{
|
||||
// Try Landlock first (kernel feature detection)
|
||||
if Self::probe_landlock() {
|
||||
return SandboxingStrategy::Landlock;
|
||||
}
|
||||
|
||||
// Try Firejail (user-space tool detection)
|
||||
if Self::probe_firejail() {
|
||||
return SandboxingStrategy::Firejail;
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(target_os = "macos")]
|
||||
{
|
||||
if Self::probe_bubblewrap() {
|
||||
return SandboxingStrategy::Bubblewrap;
|
||||
}
|
||||
}
|
||||
|
||||
// Always available fallback
|
||||
SandboxingStrategy::ApplicationLayer
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
**Same binary runs everywhere** — it just adapts its protection level based on what's available.
|
||||
|
||||
---
|
||||
|
||||
## 4. Small Hardware: Memory Impact Analysis
|
||||
|
||||
### Binary Size Impact (Estimated)
|
||||
|
||||
| Feature | Code Size | RAM Overhead | Status |
|
||||
|---------|-----------|--------------|--------|
|
||||
| **Base ZeroClaw** | 3.4MB | <5MB | ✅ Current |
|
||||
| **+ Landlock** | +50KB | +100KB | ✅ Linux 5.13+ |
|
||||
| **+ Firejail wrapper** | +20KB | +0KB (external) | ✅ Linux + firejail |
|
||||
| **+ Memory monitoring** | +30KB | +50KB | ✅ All platforms |
|
||||
| **+ Audit logging** | +40KB | +200KB (buffered) | ✅ All platforms |
|
||||
| **Full security** | +140KB | +350KB | ✅ Still <6MB total |
|
||||
|
||||
### $10 Hardware Compatibility
|
||||
|
||||
| Hardware | RAM | ZeroClaw (base) | ZeroClaw (full security) | Status |
|
||||
|----------|-----|-----------------|--------------------------|--------|
|
||||
| **Raspberry Pi Zero** | 512MB | ✅ 2% | ✅ 2.5% | Works |
|
||||
| **Orange Pi Zero** | 512MB | ✅ 2% | ✅ 2.5% | Works |
|
||||
| **NanoPi NEO** | 256MB | ✅ 4% | ✅ 5% | Works |
|
||||
| **C.H.I.P.** | 512MB | ✅ 2% | ✅ 2.5% | Works |
|
||||
| **Rock64** | 1GB | ✅ 1% | ✅ 1.2% | Works |
|
||||
|
||||
**Even with full security, ZeroClaw uses <5% of RAM on $10 boards.**
|
||||
|
||||
---
|
||||
|
||||
## 5. Agnostic Swaps: Everything Remains Pluggable
|
||||
|
||||
### ZeroClaw's Core Promise: Swap Anything
|
||||
|
||||
```rust
|
||||
// Providers (already pluggable)
|
||||
Box<dyn Provider>
|
||||
|
||||
// Channels (already pluggable)
|
||||
Box<dyn Channel>
|
||||
|
||||
// Memory (already pluggable)
|
||||
Box<dyn MemoryBackend>
|
||||
|
||||
// Tunnels (already pluggable)
|
||||
Box<dyn Tunnel>
|
||||
|
||||
// NOW ALSO: Security (newly pluggable)
|
||||
Box<dyn Sandbox>
|
||||
Box<dyn Auditor>
|
||||
Box<dyn ResourceMonitor>
|
||||
```
|
||||
|
||||
### Swap Security Backends via Config
|
||||
|
||||
```toml
|
||||
# Use no sandbox (fastest, app-layer only)
|
||||
[security.sandbox]
|
||||
backend = "none"
|
||||
|
||||
# Use Landlock (Linux kernel LSM, native)
|
||||
[security.sandbox]
|
||||
backend = "landlock"
|
||||
|
||||
# Use Firejail (user-space, needs firejail installed)
|
||||
[security.sandbox]
|
||||
backend = "firejail"
|
||||
|
||||
# Use Docker (heaviest, most isolated)
|
||||
[security.sandbox]
|
||||
backend = "docker"
|
||||
```
|
||||
|
||||
**Just like swapping OpenAI for Gemini, or SQLite for PostgreSQL.**
|
||||
|
||||
---
|
||||
|
||||
## 6. Dependency Impact: Minimal New Deps
|
||||
|
||||
### Current Dependencies (for context)
|
||||
```
|
||||
reqwest, tokio, serde, anyhow, uuid, chrono, rusqlite,
|
||||
axum, tracing, opentelemetry, ...
|
||||
```
|
||||
|
||||
### Security Feature Dependencies
|
||||
|
||||
| Feature | New Dependencies | Platform |
|
||||
|---------|------------------|----------|
|
||||
| **Landlock** | `landlock` crate (pure Rust) | Linux only |
|
||||
| **Firejail** | None (external binary) | Linux only |
|
||||
| **Bubblewrap** | None (external binary) | macOS/Linux |
|
||||
| **Docker** | `bollard` crate (Docker API) | All platforms |
|
||||
| **Memory monitoring** | None (std::alloc) | All platforms |
|
||||
| **Audit logging** | None (already have hmac/sha2) | All platforms |
|
||||
|
||||
**Result**: Most features add **zero new Rust dependencies** — they either:
|
||||
1. Use pure-Rust crates (landlock)
|
||||
2. Wrap external binaries (Firejail, Bubblewrap)
|
||||
3. Use existing deps (hmac, sha2 already in Cargo.toml)
|
||||
|
||||
---
|
||||
|
||||
## Summary: Core Value Propositions Preserved
|
||||
|
||||
| Value Prop | Before | After (with security) | Status |
|
||||
|------------|--------|----------------------|--------|
|
||||
| **<5MB RAM** | ✅ <5MB | ✅ <6MB (worst case) | ✅ Preserved |
|
||||
| **<10ms startup** | ✅ <10ms | ✅ <15ms (detection) | ✅ Preserved |
|
||||
| **3.4MB binary** | ✅ 3.4MB | ✅ 3.5MB (with all features) | ✅ Preserved |
|
||||
| **ARM + x86 + RISC-V** | ✅ All | ✅ All | ✅ Preserved |
|
||||
| **$10 hardware** | ✅ Works | ✅ Works | ✅ Preserved |
|
||||
| **Pluggable everything** | ✅ Yes | ✅ Yes (security too) | ✅ Enhanced |
|
||||
| **Cross-platform** | ✅ Yes | ✅ Yes | ✅ Preserved |
|
||||
|
||||
---
|
||||
|
||||
## The Key: Feature Flags + Conditional Compilation
|
||||
|
||||
```bash
|
||||
# Developer build (fastest, no extra features)
|
||||
cargo build --profile dev
|
||||
|
||||
# Standard release (your current build)
|
||||
cargo build --release
|
||||
|
||||
# Production with full security
|
||||
cargo build --release --features security-full
|
||||
|
||||
# Target specific hardware
|
||||
cargo build --release --target aarch64-unknown-linux-gnu # Raspberry Pi
|
||||
cargo build --release --target riscv64gc-unknown-linux-gnu # RISC-V
|
||||
cargo build --release --target armv7-unknown-linux-gnueabihf # ARMv7
|
||||
```
|
||||
|
||||
**Every target, every platform, every use case — still fast, still small, still agnostic.**
|
||||
186
docs/audit-logging.md
Normal file
186
docs/audit-logging.md
Normal file
|
|
@ -0,0 +1,186 @@
|
|||
# Audit Logging for ZeroClaw
|
||||
|
||||
## Problem
|
||||
ZeroClaw logs actions but lacks tamper-evident audit trails for:
|
||||
- Who executed what command
|
||||
- When and from which channel
|
||||
- What resources were accessed
|
||||
- Whether security policies were triggered
|
||||
|
||||
---
|
||||
|
||||
## Proposed Audit Log Format
|
||||
|
||||
```json
|
||||
{
|
||||
"timestamp": "2026-02-16T12:34:56Z",
|
||||
"event_id": "evt_1a2b3c4d",
|
||||
"event_type": "command_execution",
|
||||
"actor": {
|
||||
"channel": "telegram",
|
||||
"user_id": "123456789",
|
||||
"username": "@alice"
|
||||
},
|
||||
"action": {
|
||||
"command": "ls -la",
|
||||
"risk_level": "low",
|
||||
"approved": false,
|
||||
"allowed": true
|
||||
},
|
||||
"result": {
|
||||
"success": true,
|
||||
"exit_code": 0,
|
||||
"duration_ms": 15
|
||||
},
|
||||
"security": {
|
||||
"policy_violation": false,
|
||||
"rate_limit_remaining": 19
|
||||
},
|
||||
"signature": "SHA256:abc123..." // HMAC for tamper evidence
|
||||
}
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Implementation
|
||||
|
||||
```rust
|
||||
// src/security/audit.rs
|
||||
use serde::{Deserialize, Serialize};
|
||||
use std::io::Write;
|
||||
use std::path::PathBuf;
|
||||
|
||||
#[derive(Debug, Clone, Serialize, Deserialize)]
|
||||
pub struct AuditEvent {
|
||||
pub timestamp: String,
|
||||
pub event_id: String,
|
||||
pub event_type: AuditEventType,
|
||||
pub actor: Actor,
|
||||
pub action: Action,
|
||||
pub result: ExecutionResult,
|
||||
pub security: SecurityContext,
|
||||
}
|
||||
|
||||
#[derive(Debug, Clone, Serialize, Deserialize)]
|
||||
pub enum AuditEventType {
|
||||
CommandExecution,
|
||||
FileAccess,
|
||||
ConfigurationChange,
|
||||
AuthSuccess,
|
||||
AuthFailure,
|
||||
PolicyViolation,
|
||||
}
|
||||
|
||||
pub struct AuditLogger {
|
||||
log_path: PathBuf,
|
||||
signing_key: Option<hmac::Hmac<sha2::Sha256>>,
|
||||
}
|
||||
|
||||
impl AuditLogger {
|
||||
pub fn log(&self, event: &AuditEvent) -> anyhow::Result<()> {
|
||||
let mut line = serde_json::to_string(event)?;
|
||||
|
||||
// Add HMAC signature if key configured
|
||||
if let Some(ref key) = self.signing_key {
|
||||
let signature = compute_hmac(key, line.as_bytes());
|
||||
line.push_str(&format!("\n\"signature\": \"{}\"", signature));
|
||||
}
|
||||
|
||||
let mut file = std::fs::OpenOptions::new()
|
||||
.create(true)
|
||||
.append(true)
|
||||
.open(&self.log_path)?;
|
||||
|
||||
writeln!(file, "{}", line)?;
|
||||
file.sync_all()?; // Force flush for durability
|
||||
Ok(())
|
||||
}
|
||||
|
||||
pub fn search(&self, filter: AuditFilter) -> Vec<AuditEvent> {
|
||||
// Search log file by filter criteria
|
||||
todo!()
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Config Schema
|
||||
|
||||
```toml
|
||||
[security.audit]
|
||||
enabled = true
|
||||
log_path = "~/.config/zeroclaw/audit.log"
|
||||
max_size_mb = 100
|
||||
rotate = "daily" # daily | weekly | size
|
||||
|
||||
# Tamper evidence
|
||||
sign_events = true
|
||||
signing_key_path = "~/.config/zeroclaw/audit.key"
|
||||
|
||||
# What to log
|
||||
log_commands = true
|
||||
log_file_access = true
|
||||
log_auth_events = true
|
||||
log_policy_violations = true
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Audit Query CLI
|
||||
|
||||
```bash
|
||||
# Show all commands executed by @alice
|
||||
zeroclaw audit --user @alice
|
||||
|
||||
# Show all high-risk commands
|
||||
zeroclaw audit --risk high
|
||||
|
||||
# Show violations from last 24 hours
|
||||
zeroclaw audit --since 24h --violations-only
|
||||
|
||||
# Export to JSON for analysis
|
||||
zeroclaw audit --format json --output audit.json
|
||||
|
||||
# Verify log integrity
|
||||
zeroclaw audit --verify-signatures
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Log Rotation
|
||||
|
||||
```rust
|
||||
pub fn rotate_audit_log(log_path: &PathBuf, max_size: u64) -> anyhow::Result<()> {
|
||||
let metadata = std::fs::metadata(log_path)?;
|
||||
if metadata.len() < max_size {
|
||||
return Ok(());
|
||||
}
|
||||
|
||||
// Rotate: audit.log -> audit.log.1 -> audit.log.2 -> ...
|
||||
let stem = log_path.file_stem().unwrap_or_default();
|
||||
let extension = log_path.extension().and_then(|s| s.to_str()).unwrap_or("log");
|
||||
|
||||
for i in (1..10).rev() {
|
||||
let old_name = format!("{}.{}.{}", stem, i, extension);
|
||||
let new_name = format!("{}.{}.{}", stem, i + 1, extension);
|
||||
let _ = std::fs::rename(old_name, new_name);
|
||||
}
|
||||
|
||||
let rotated = format!("{}.1.{}", stem, extension);
|
||||
std::fs::rename(log_path, &rotated)?;
|
||||
|
||||
Ok(())
|
||||
}
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Implementation Priority
|
||||
|
||||
| Phase | Feature | Effort | Security Value |
|
||||
|-------|---------|--------|----------------|
|
||||
| **P0** | Basic event logging | Low | Medium |
|
||||
| **P1** | Query CLI | Medium | Medium |
|
||||
| **P2** | HMAC signing | Medium | High |
|
||||
| **P3** | Log rotation + archival | Low | Medium |
|
||||
312
docs/frictionless-security.md
Normal file
312
docs/frictionless-security.md
Normal file
|
|
@ -0,0 +1,312 @@
|
|||
# Frictionless Security: Zero Impact on Wizard
|
||||
|
||||
## Core Principle
|
||||
> **"Security features should be like airbags — present, protective, and invisible until needed."**
|
||||
|
||||
## Design: Silent Auto-Detection
|
||||
|
||||
### 1. No New Wizard Steps (Stays 9 Steps, < 60 Seconds)
|
||||
|
||||
```rust
|
||||
// Wizard remains UNCHANGED
|
||||
// Security features auto-detect in background
|
||||
|
||||
pub fn run_wizard() -> Result<Config> {
|
||||
// ... existing 9 steps, no changes ...
|
||||
|
||||
let config = Config {
|
||||
// ... existing fields ...
|
||||
|
||||
// NEW: Auto-detected security (not shown in wizard)
|
||||
security: SecurityConfig::autodetect(), // Silent!
|
||||
};
|
||||
|
||||
config.save()?;
|
||||
Ok(config)
|
||||
}
|
||||
```
|
||||
|
||||
### 2. Auto-Detection Logic (Runs Once at First Start)
|
||||
|
||||
```rust
|
||||
// src/security/detect.rs
|
||||
|
||||
impl SecurityConfig {
|
||||
/// Detect available sandboxing and enable automatically
|
||||
/// Returns smart defaults based on platform + available tools
|
||||
pub fn autodetect() -> Self {
|
||||
Self {
|
||||
// Sandbox: prefer Landlock (native), then Firejail, then none
|
||||
sandbox: SandboxConfig::autodetect(),
|
||||
|
||||
// Resource limits: always enable monitoring
|
||||
resources: ResourceLimits::default(),
|
||||
|
||||
// Audit: enable by default, log to config dir
|
||||
audit: AuditConfig::default(),
|
||||
|
||||
// Everything else: safe defaults
|
||||
..SecurityConfig::default()
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
impl SandboxConfig {
|
||||
pub fn autodetect() -> Self {
|
||||
#[cfg(target_os = "linux")]
|
||||
{
|
||||
// Prefer Landlock (native, no dependency)
|
||||
if Self::probe_landlock() {
|
||||
return Self {
|
||||
enabled: true,
|
||||
backend: SandboxBackend::Landlock,
|
||||
..Self::default()
|
||||
};
|
||||
}
|
||||
|
||||
// Fallback: Firejail if installed
|
||||
if Self::probe_firejail() {
|
||||
return Self {
|
||||
enabled: true,
|
||||
backend: SandboxBackend::Firejail,
|
||||
..Self::default()
|
||||
};
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(target_os = "macos")]
|
||||
{
|
||||
// Try Bubblewrap on macOS
|
||||
if Self::probe_bubblewrap() {
|
||||
return Self {
|
||||
enabled: true,
|
||||
backend: SandboxBackend::Bubblewrap,
|
||||
..Self::default()
|
||||
};
|
||||
}
|
||||
}
|
||||
|
||||
// Fallback: disabled (but still has application-layer security)
|
||||
Self {
|
||||
enabled: false,
|
||||
backend: SandboxBackend::None,
|
||||
..Self::default()
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(target_os = "linux")]
|
||||
fn probe_landlock() -> bool {
|
||||
// Try creating a minimal Landlock ruleset
|
||||
// If it works, kernel supports Landlock
|
||||
landlock::Ruleset::new()
|
||||
.set_access_fs(landlock::AccessFS::read_file)
|
||||
.add_path(Path::new("/tmp"), landlock::AccessFS::read_file)
|
||||
.map(|ruleset| ruleset.restrict_self().is_ok())
|
||||
.unwrap_or(false)
|
||||
}
|
||||
|
||||
fn probe_firejail() -> bool {
|
||||
// Check if firejail command exists
|
||||
std::process::Command::new("firejail")
|
||||
.arg("--version")
|
||||
.output()
|
||||
.map(|o| o.status.success())
|
||||
.unwrap_or(false)
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
### 3. First Run: Silent Logging
|
||||
|
||||
```bash
|
||||
$ zeroclaw agent -m "hello"
|
||||
|
||||
# First time: silent detection
|
||||
[INFO] Detecting security features...
|
||||
[INFO] ✓ Landlock sandbox enabled (kernel 6.2+)
|
||||
[INFO] ✓ Memory monitoring active (512MB limit)
|
||||
[INFO] ✓ Audit logging enabled (~/.config/zeroclaw/audit.log)
|
||||
|
||||
# Subsequent runs: quiet
|
||||
$ zeroclaw agent -m "hello"
|
||||
[agent] Thinking...
|
||||
```
|
||||
|
||||
### 4. Config File: All Defaults Hidden
|
||||
|
||||
```toml
|
||||
# ~/.config/zeroclaw/config.toml
|
||||
|
||||
# These sections are NOT written unless user customizes
|
||||
# [security.sandbox]
|
||||
# enabled = true # (default, auto-detected)
|
||||
# backend = "landlock" # (default, auto-detected)
|
||||
|
||||
# [security.resources]
|
||||
# max_memory_mb = 512 # (default)
|
||||
|
||||
# [security.audit]
|
||||
# enabled = true # (default)
|
||||
```
|
||||
|
||||
Only when user changes something:
|
||||
```toml
|
||||
[security.sandbox]
|
||||
enabled = false # User explicitly disabled
|
||||
|
||||
[security.resources]
|
||||
max_memory_mb = 1024 # User increased limit
|
||||
```
|
||||
|
||||
### 5. Advanced Users: Explicit Control
|
||||
|
||||
```bash
|
||||
# Check what's active
|
||||
$ zeroclaw security --status
|
||||
Security Status:
|
||||
✓ Sandbox: Landlock (Linux kernel 6.2)
|
||||
✓ Memory monitoring: 512MB limit
|
||||
✓ Audit logging: ~/.config/zeroclaw/audit.log
|
||||
→ 47 events logged today
|
||||
|
||||
# Disable sandbox explicitly (writes to config)
|
||||
$ zeroclaw config set security.sandbox.enabled false
|
||||
|
||||
# Enable specific backend
|
||||
$ zeroclaw config set security.sandbox.backend firejail
|
||||
|
||||
# Adjust limits
|
||||
$ zeroclaw config set security.resources.max_memory_mb 2048
|
||||
```
|
||||
|
||||
### 6. Graceful Degradation
|
||||
|
||||
| Platform | Best Available | Fallback | Worst Case |
|
||||
|----------|---------------|----------|------------|
|
||||
| **Linux 5.13+** | Landlock | None | App-layer only |
|
||||
| **Linux (any)** | Firejail | Landlock | App-layer only |
|
||||
| **macOS** | Bubblewrap | None | App-layer only |
|
||||
| **Windows** | None | - | App-layer only |
|
||||
|
||||
**App-layer security is always present** — this is the existing allowlist/path blocking/injection protection that's already comprehensive.
|
||||
|
||||
---
|
||||
|
||||
## Config Schema Extension
|
||||
|
||||
```rust
|
||||
// src/config/schema.rs
|
||||
|
||||
#[derive(Debug, Clone, Serialize, Deserialize)]
|
||||
pub struct SecurityConfig {
|
||||
/// Sandbox configuration (auto-detected if not set)
|
||||
#[serde(default)]
|
||||
pub sandbox: SandboxConfig,
|
||||
|
||||
/// Resource limits (defaults applied if not set)
|
||||
#[serde(default)]
|
||||
pub resources: ResourceLimits,
|
||||
|
||||
/// Audit logging (enabled by default)
|
||||
#[serde(default)]
|
||||
pub audit: AuditConfig,
|
||||
}
|
||||
|
||||
impl Default for SecurityConfig {
|
||||
fn default() -> Self {
|
||||
Self {
|
||||
sandbox: SandboxConfig::autodetect(), // Silent detection!
|
||||
resources: ResourceLimits::default(),
|
||||
audit: AuditConfig::default(),
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
#[derive(Debug, Clone, Serialize, Deserialize)]
|
||||
pub struct SandboxConfig {
|
||||
/// Enable sandboxing (default: auto-detected)
|
||||
#[serde(default)]
|
||||
pub enabled: Option<bool>, // None = auto-detect
|
||||
|
||||
/// Sandbox backend (default: auto-detect)
|
||||
#[serde(default)]
|
||||
pub backend: SandboxBackend,
|
||||
|
||||
/// Custom Firejail args (optional)
|
||||
#[serde(default)]
|
||||
pub firejail_args: Vec<String>,
|
||||
}
|
||||
|
||||
#[derive(Debug, Clone, Serialize, Deserialize)]
|
||||
#[serde(rename_all = "lowercase")]
|
||||
pub enum SandboxBackend {
|
||||
Auto, // Auto-detect (default)
|
||||
Landlock, // Linux kernel LSM
|
||||
Firejail, // User-space sandbox
|
||||
Bubblewrap, // User namespaces
|
||||
Docker, // Container (heavy)
|
||||
None, // Disabled
|
||||
}
|
||||
|
||||
impl Default for SandboxBackend {
|
||||
fn default() -> Self {
|
||||
Self::Auto // Always auto-detect by default
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## User Experience Comparison
|
||||
|
||||
### Before (Current)
|
||||
```bash
|
||||
$ zeroclaw onboard
|
||||
[1/9] Workspace Setup...
|
||||
[2/9] AI Provider...
|
||||
...
|
||||
[9/9] Workspace Files...
|
||||
✓ Security: Supervised | workspace-scoped
|
||||
```
|
||||
|
||||
### After (With Frictionless Security)
|
||||
```bash
|
||||
$ zeroclaw onboard
|
||||
[1/9] Workspace Setup...
|
||||
[2/9] AI Provider...
|
||||
...
|
||||
[9/9] Workspace Files...
|
||||
✓ Security: Supervised | workspace-scoped | Landlock sandbox ✓
|
||||
# ↑ Just one extra word, silent auto-detection!
|
||||
```
|
||||
|
||||
### Advanced User (Explicit Control)
|
||||
```bash
|
||||
$ zeroclaw onboard --security-level paranoid
|
||||
[1/9] Workspace Setup...
|
||||
...
|
||||
✓ Security: Paranoid | Landlock + Firejail | Audit signed
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Backward Compatibility
|
||||
|
||||
| Scenario | Behavior |
|
||||
|----------|----------|
|
||||
| **Existing config** | Works unchanged, new features opt-in |
|
||||
| **New install** | Auto-detects and enables available security |
|
||||
| **No sandbox available** | Falls back to app-layer (still secure) |
|
||||
| **User disables** | One config flag: `sandbox.enabled = false` |
|
||||
|
||||
---
|
||||
|
||||
## Summary
|
||||
|
||||
✅ **Zero impact on wizard** — stays 9 steps, < 60 seconds
|
||||
✅ **Zero new prompts** — silent auto-detection
|
||||
✅ **Zero breaking changes** — backward compatible
|
||||
✅ **Opt-out available** — explicit config flags
|
||||
✅ **Status visibility** — `zeroclaw security --status`
|
||||
|
||||
The wizard remains "quick setup universal applications" — security is just **quietly better**.
|
||||
100
docs/resource-limits.md
Normal file
100
docs/resource-limits.md
Normal file
|
|
@ -0,0 +1,100 @@
|
|||
# Resource Limits for ZeroClaw
|
||||
|
||||
## Problem
|
||||
ZeroClaw has rate limiting (20 actions/hour) but no resource caps. A runaway agent could:
|
||||
- Exhaust available memory
|
||||
- Spin CPU at 100%
|
||||
- Fill disk with logs/output
|
||||
|
||||
---
|
||||
|
||||
## Proposed Solutions
|
||||
|
||||
### Option 1: cgroups v2 (Linux, Recommended)
|
||||
Automatically create a cgroup for zeroclaw with limits.
|
||||
|
||||
```bash
|
||||
# Create systemd service with limits
|
||||
[Service]
|
||||
MemoryMax=512M
|
||||
CPUQuota=100%
|
||||
IOReadBandwidthMax=/dev/sda 10M
|
||||
IOWriteBandwidthMax=/dev/sda 10M
|
||||
TasksMax=100
|
||||
```
|
||||
|
||||
### Option 2: tokio::task::deadlock detection
|
||||
Prevent task starvation.
|
||||
|
||||
```rust
|
||||
use tokio::time::{timeout, Duration};
|
||||
|
||||
pub async fn execute_with_timeout<F, T>(
|
||||
fut: F,
|
||||
cpu_time_limit: Duration,
|
||||
memory_limit: usize,
|
||||
) -> Result<T>
|
||||
where
|
||||
F: Future<Output = Result<T>>,
|
||||
{
|
||||
// CPU timeout
|
||||
timeout(cpu_time_limit, fut).await?
|
||||
}
|
||||
```
|
||||
|
||||
### Option 3: Memory monitoring
|
||||
Track heap usage and kill if over limit.
|
||||
|
||||
```rust
|
||||
use std::alloc::{GlobalAlloc, Layout, System};
|
||||
|
||||
struct LimitedAllocator<A> {
|
||||
inner: A,
|
||||
max_bytes: usize,
|
||||
used: std::sync::atomic::AtomicUsize,
|
||||
}
|
||||
|
||||
unsafe impl<A: GlobalAlloc> GlobalAlloc for LimitedAllocator<A> {
|
||||
unsafe fn alloc(&self, layout: Layout) -> *mut u8 {
|
||||
let current = self.used.fetch_add(layout.size(), std::sync::atomic::Ordering::Relaxed);
|
||||
if current + layout.size() > self.max_bytes {
|
||||
std::process::abort();
|
||||
}
|
||||
self.inner.alloc(layout)
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Config Schema
|
||||
|
||||
```toml
|
||||
[resources]
|
||||
# Memory limits (in MB)
|
||||
max_memory_mb = 512
|
||||
max_memory_per_command_mb = 128
|
||||
|
||||
# CPU limits
|
||||
max_cpu_percent = 50
|
||||
max_cpu_time_seconds = 60
|
||||
|
||||
# Disk I/O limits
|
||||
max_log_size_mb = 100
|
||||
max_temp_storage_mb = 500
|
||||
|
||||
# Process limits
|
||||
max_subprocesses = 10
|
||||
max_open_files = 100
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Implementation Priority
|
||||
|
||||
| Phase | Feature | Effort | Impact |
|
||||
|-------|---------|--------|--------|
|
||||
| **P0** | Memory monitoring + kill | Low | High |
|
||||
| **P1** | CPU timeout per command | Low | High |
|
||||
| **P2** | cgroups integration (Linux) | Medium | Very High |
|
||||
| **P3** | Disk I/O limits | Medium | Medium |
|
||||
190
docs/sandboxing.md
Normal file
190
docs/sandboxing.md
Normal file
|
|
@ -0,0 +1,190 @@
|
|||
# ZeroClaw Sandboxing Strategies
|
||||
|
||||
## Problem
|
||||
ZeroClaw currently has application-layer security (allowlists, path blocking, command injection protection) but lacks OS-level containment. If an attacker is on the allowlist, they can run any allowed command with zeroclaw's user permissions.
|
||||
|
||||
## Proposed Solutions
|
||||
|
||||
### Option 1: Firejail Integration (Recommended for Linux)
|
||||
Firejail provides user-space sandboxing with minimal overhead.
|
||||
|
||||
```rust
|
||||
// src/security/firejail.rs
|
||||
use std::process::Command;
|
||||
|
||||
pub struct FirejailSandbox {
|
||||
enabled: bool,
|
||||
}
|
||||
|
||||
impl FirejailSandbox {
|
||||
pub fn new() -> Self {
|
||||
let enabled = which::which("firejail").is_ok();
|
||||
Self { enabled }
|
||||
}
|
||||
|
||||
pub fn wrap_command(&self, cmd: &mut Command) -> &mut Command {
|
||||
if !self.enabled {
|
||||
return cmd;
|
||||
}
|
||||
|
||||
// Firejail wraps any command with sandboxing
|
||||
let mut jail = Command::new("firejail");
|
||||
jail.args([
|
||||
"--private=home", // New home directory
|
||||
"--private-dev", // Minimal /dev
|
||||
"--nosound", // No audio
|
||||
"--no3d", // No 3D acceleration
|
||||
"--novideo", // No video devices
|
||||
"--nowheel", // No input devices
|
||||
"--notv", // No TV devices
|
||||
"--noprofile", // Skip profile loading
|
||||
"--quiet", // Suppress warnings
|
||||
]);
|
||||
|
||||
// Append original command
|
||||
if let Some(program) = cmd.get_program().to_str() {
|
||||
jail.arg(program);
|
||||
}
|
||||
for arg in cmd.get_args() {
|
||||
if let Some(s) = arg.to_str() {
|
||||
jail.arg(s);
|
||||
}
|
||||
}
|
||||
|
||||
// Replace original command with firejail wrapper
|
||||
*cmd = jail;
|
||||
cmd
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
**Config option:**
|
||||
```toml
|
||||
[security]
|
||||
enable_sandbox = true
|
||||
sandbox_backend = "firejail" # or "none", "bubblewrap", "docker"
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### Option 2: Bubblewrap (Portable, no root required)
|
||||
Bubblewrap uses user namespaces to create containers.
|
||||
|
||||
```bash
|
||||
# Install bubblewrap
|
||||
sudo apt install bubblewrap
|
||||
|
||||
# Wrap command:
|
||||
bwrap --ro-bind /usr /usr \
|
||||
--dev /dev \
|
||||
--proc /proc \
|
||||
--bind /workspace /workspace \
|
||||
--unshare-all \
|
||||
--share-net \
|
||||
--die-with-parent \
|
||||
-- /bin/sh -c "command"
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### Option 3: Docker-in-Docker (Heavyweight but complete isolation)
|
||||
Run agent tools inside ephemeral containers.
|
||||
|
||||
```rust
|
||||
pub struct DockerSandbox {
|
||||
image: String,
|
||||
}
|
||||
|
||||
impl DockerSandbox {
|
||||
pub async fn execute(&self, command: &str, workspace: &Path) -> Result<String> {
|
||||
let output = Command::new("docker")
|
||||
.args([
|
||||
"run", "--rm",
|
||||
"--memory", "512m",
|
||||
"--cpus", "1.0",
|
||||
"--network", "none",
|
||||
"--volume", &format!("{}:/workspace", workspace.display()),
|
||||
&self.image,
|
||||
"sh", "-c", command
|
||||
])
|
||||
.output()
|
||||
.await?;
|
||||
|
||||
Ok(String::from_utf8_lossy(&output.stdout).to_string())
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### Option 4: Landlock (Linux Kernel LSM, Rust native)
|
||||
Landlock provides file system access control without containers.
|
||||
|
||||
```rust
|
||||
use landlock::{Ruleset, AccessFS};
|
||||
|
||||
pub fn apply_landlock() -> Result<()> {
|
||||
let ruleset = Ruleset::new()
|
||||
.set_access_fs(AccessFS::read_file | AccessFS::write_file)
|
||||
.add_path(Path::new("/workspace"), AccessFS::read_file | AccessFS::write_file)?
|
||||
.add_path(Path::new("/tmp"), AccessFS::read_file | AccessFS::write_file)?
|
||||
.restrict_self()?;
|
||||
|
||||
Ok(())
|
||||
}
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Priority Implementation Order
|
||||
|
||||
| Phase | Solution | Effort | Security Gain |
|
||||
|-------|----------|--------|---------------|
|
||||
| **P0** | Landlock (Linux only, native) | Low | High (filesystem) |
|
||||
| **P1** | Firejail integration | Low | Very High |
|
||||
| **P2** | Bubblewrap wrapper | Medium | Very High |
|
||||
| **P3** | Docker sandbox mode | High | Complete |
|
||||
|
||||
## Config Schema Extension
|
||||
|
||||
```toml
|
||||
[security.sandbox]
|
||||
enabled = true
|
||||
backend = "auto" # auto | firejail | bubblewrap | landlock | docker | none
|
||||
|
||||
# Firejail-specific
|
||||
[security.sandbox.firejail]
|
||||
extra_args = ["--seccomp", "--caps.drop=all"]
|
||||
|
||||
# Landlock-specific
|
||||
[security.sandbox.landlock]
|
||||
readonly_paths = ["/usr", "/bin", "/lib"]
|
||||
readwrite_paths = ["$HOME/workspace", "/tmp/zeroclaw"]
|
||||
```
|
||||
|
||||
## Testing Strategy
|
||||
|
||||
```rust
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
#[test]
|
||||
fn sandbox_blocks_path_traversal() {
|
||||
// Try to read /etc/passwd through sandbox
|
||||
let result = sandboxed_execute("cat /etc/passwd");
|
||||
assert!(result.is_err());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn sandbox_allows_workspace_access() {
|
||||
let result = sandboxed_execute("ls /workspace");
|
||||
assert!(result.is_ok());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn sandbox_no_network_isolation() {
|
||||
// Ensure network is blocked when configured
|
||||
let result = sandboxed_execute("curl http://example.com");
|
||||
assert!(result.is_err());
|
||||
}
|
||||
}
|
||||
```
|
||||
180
docs/security-roadmap.md
Normal file
180
docs/security-roadmap.md
Normal file
|
|
@ -0,0 +1,180 @@
|
|||
# ZeroClaw Security Improvement Roadmap
|
||||
|
||||
## Current State: Strong Foundation
|
||||
|
||||
ZeroClaw already has **excellent application-layer security**:
|
||||
|
||||
✅ Command allowlist (not blocklist)
|
||||
✅ Path traversal protection
|
||||
✅ Command injection blocking (`$(...)`, backticks, `&&`, `>`)
|
||||
✅ Secret isolation (API keys not leaked to shell)
|
||||
✅ Rate limiting (20 actions/hour)
|
||||
✅ Channel authorization (empty = deny all, `*` = allow all)
|
||||
✅ Risk classification (Low/Medium/High)
|
||||
✅ Environment variable sanitization
|
||||
✅ Forbidden paths blocking
|
||||
✅ Comprehensive test coverage (1,017 tests)
|
||||
|
||||
## What's Missing: OS-Level Containment
|
||||
|
||||
🔴 No OS-level sandboxing (chroot, containers, namespaces)
|
||||
🔴 No resource limits (CPU, memory, disk I/O caps)
|
||||
🔴 No tamper-evident audit logging
|
||||
🔴 No syscall filtering (seccomp)
|
||||
|
||||
---
|
||||
|
||||
## Comparison: ZeroClaw vs PicoClaw vs Production Grade
|
||||
|
||||
| Feature | PicoClaw | ZeroClaw Now | ZeroClaw + Roadmap | Production Target |
|
||||
|---------|----------|--------------|-------------------|-------------------|
|
||||
| **Binary Size** | ~8MB | **3.4MB** ✅ | 3.5-4MB | < 5MB |
|
||||
| **RAM Usage** | < 10MB | **< 5MB** ✅ | < 10MB | < 20MB |
|
||||
| **Startup Time** | < 1s | **< 10ms** ✅ | < 50ms | < 100ms |
|
||||
| **Command Allowlist** | Unknown | ✅ Yes | ✅ Yes | ✅ Yes |
|
||||
| **Path Blocking** | Unknown | ✅ Yes | ✅ Yes | ✅ Yes |
|
||||
| **Injection Protection** | Unknown | ✅ Yes | ✅ Yes | ✅ Yes |
|
||||
| **OS Sandbox** | No | ❌ No | ✅ Firejail/Landlock | ✅ Container/namespaces |
|
||||
| **Resource Limits** | No | ❌ No | ✅ cgroups/Monitor | ✅ Full cgroups |
|
||||
| **Audit Logging** | No | ❌ No | ✅ HMAC-signed | ✅ SIEM integration |
|
||||
| **Security Score** | C | **B+** | **A-** | **A+** |
|
||||
|
||||
---
|
||||
|
||||
## Implementation Roadmap
|
||||
|
||||
### Phase 1: Quick Wins (1-2 weeks)
|
||||
**Goal**: Address critical gaps with minimal complexity
|
||||
|
||||
| Task | File | Effort | Impact |
|
||||
|------|------|--------|-------|
|
||||
| Landlock filesystem sandbox | `src/security/landlock.rs` | 2 days | High |
|
||||
| Memory monitoring + OOM kill | `src/resources/memory.rs` | 1 day | High |
|
||||
| CPU timeout per command | `src/tools/shell.rs` | 1 day | High |
|
||||
| Basic audit logging | `src/security/audit.rs` | 2 days | Medium |
|
||||
| Config schema updates | `src/config/schema.rs` | 1 day | - |
|
||||
|
||||
**Deliverables**:
|
||||
- Linux: Filesystem access restricted to workspace
|
||||
- All platforms: Memory/CPU guards against runaway commands
|
||||
- All platforms: Tamper-evident audit trail
|
||||
|
||||
---
|
||||
|
||||
### Phase 2: Platform Integration (2-3 weeks)
|
||||
**Goal**: Deep OS integration for production-grade isolation
|
||||
|
||||
| Task | Effort | Impact |
|
||||
|------|--------|-------|
|
||||
| Firejail auto-detection + wrapping | 3 days | Very High |
|
||||
| Bubblewrap wrapper for macOS/*nix | 4 days | Very High |
|
||||
| cgroups v2 systemd integration | 3 days | High |
|
||||
| seccomp syscall filtering | 5 days | High |
|
||||
| Audit log query CLI | 2 days | Medium |
|
||||
|
||||
**Deliverables**:
|
||||
- Linux: Full container-like isolation via Firejail
|
||||
- macOS: Bubblewrap filesystem isolation
|
||||
- Linux: cgroups resource enforcement
|
||||
- Linux: Syscall allowlisting
|
||||
|
||||
---
|
||||
|
||||
### Phase 3: Production Hardening (1-2 weeks)
|
||||
**Goal**: Enterprise security features
|
||||
|
||||
| Task | Effort | Impact |
|
||||
|------|--------|-------|
|
||||
| Docker sandbox mode option | 3 days | High |
|
||||
| Certificate pinning for channels | 2 days | Medium |
|
||||
| Signed config verification | 2 days | Medium |
|
||||
| SIEM-compatible audit export | 2 days | Medium |
|
||||
| Security self-test (`zeroclaw audit --check`) | 1 day | Low |
|
||||
|
||||
**Deliverables**:
|
||||
- Optional Docker-based execution isolation
|
||||
- HTTPS certificate pinning for channel webhooks
|
||||
- Config file signature verification
|
||||
- JSON/CSV audit export for external analysis
|
||||
|
||||
---
|
||||
|
||||
## New Config Schema Preview
|
||||
|
||||
```toml
|
||||
[security]
|
||||
level = "strict" # relaxed | default | strict | paranoid
|
||||
|
||||
# Sandbox configuration
|
||||
[security.sandbox]
|
||||
enabled = true
|
||||
backend = "auto" # auto | firejail | bubblewrap | landlock | docker | none
|
||||
|
||||
# Resource limits
|
||||
[resources]
|
||||
max_memory_mb = 512
|
||||
max_memory_per_command_mb = 128
|
||||
max_cpu_percent = 50
|
||||
max_cpu_time_seconds = 60
|
||||
max_subprocesses = 10
|
||||
|
||||
# Audit logging
|
||||
[security.audit]
|
||||
enabled = true
|
||||
log_path = "~/.config/zeroclaw/audit.log"
|
||||
sign_events = true
|
||||
max_size_mb = 100
|
||||
|
||||
# Autonomy (existing, enhanced)
|
||||
[autonomy]
|
||||
level = "supervised" # readonly | supervised | full
|
||||
allowed_commands = ["git", "ls", "cat", "grep", "find"]
|
||||
forbidden_paths = ["/etc", "/root", "~/.ssh"]
|
||||
require_approval_for_medium_risk = true
|
||||
block_high_risk_commands = true
|
||||
max_actions_per_hour = 20
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## CLI Commands Preview
|
||||
|
||||
```bash
|
||||
# Security status check
|
||||
zeroclaw security --check
|
||||
# → ✓ Sandbox: Firejail active
|
||||
# → ✓ Audit logging enabled (42 events today)
|
||||
# → → Resource limits: 512MB mem, 50% CPU
|
||||
|
||||
# Audit log queries
|
||||
zeroclaw audit --user @alice --since 24h
|
||||
zeroclaw audit --risk high --violations-only
|
||||
zeroclaw audit --verify-signatures
|
||||
|
||||
# Sandbox test
|
||||
zeroclaw sandbox --test
|
||||
# → Testing isolation...
|
||||
# ✓ Cannot read /etc/passwd
|
||||
# ✓ Cannot access ~/.ssh
|
||||
# ✓ Can read /workspace
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Summary
|
||||
|
||||
**ZeroClaw is already more secure than PicoClaw** with:
|
||||
- 50% smaller binary (3.4MB vs 8MB)
|
||||
- 50% less RAM (< 5MB vs < 10MB)
|
||||
- 100x faster startup (< 10ms vs < 1s)
|
||||
- Comprehensive security policy engine
|
||||
- Extensive test coverage
|
||||
|
||||
**By implementing this roadmap**, ZeroClaw becomes:
|
||||
- Production-grade with OS-level sandboxing
|
||||
- Resource-aware with memory/CPU guards
|
||||
- Audit-ready with tamper-evident logging
|
||||
- Enterprise-ready with configurable security levels
|
||||
|
||||
**Estimated effort**: 4-7 weeks for full implementation
|
||||
**Value**: Transforms ZeroClaw from "safe for testing" to "safe for production"
|
||||
Loading…
Add table
Add a link
Reference in a new issue