fix(security): make .openclaw symlinks immutable after validation

[latenighthackathon]

Summary

The symlink validation loop in nemoclaw-start.sh verifies that all symlinks in /sandbox/.openclaw/ point to their expected /sandbox/.openclaw-data/ targets, but this check runs only once at boot. After validation completes (line 360), the gateway starts on the next line (line 366), leaving a TOCTOU window where symlinks could theoretically be swapped.

This adds defense-in-depth by setting the immutable flag (chattr +i) on both the /sandbox/.openclaw directory and its validated symlinks immediately after the validation loop passes.

Changes

• Added chattr +i on /sandbox/.openclaw directory and all symlinks after the validation loop
• Guarded behind command -v chattr check — degrades gracefully if not available
• All chattr calls use || true to avoid failures on filesystems that don't support immutable flags

Security Analysis

Layer	Protection	Status
DAC (chmod/chown)	Directory owned by root:root, mode 755	Already in place (Dockerfile)
Landlock	/sandbox/.openclaw in read-only policy	best_effort — not enforced on older kernels
Immutable flag	chattr +i prevents modification even by root	Added by this PR

The immutable flag cannot be removed by the sandbox user (requires CAP_LINUX_IMMUTABLE), closing the TOCTOU window even if DAC or Landlock are bypassed.

Test Plan

• Full test suite: 650/653 passed (3 pre-existing failures in service-env.test.js)
• Verified graceful degradation when chattr is unavailable
• Confirmed chattr guard (command -v) prevents errors in minimal containers

Closes #1019

Summary by CodeRabbit

• Chores
  • Added additional sandbox hardening: verification of internal links followed by an optional immutability step to protect those links from runtime modification, improving integrity and reducing risk of unauthorized changes.

Signed-off-by: latenighthackathon latenighthackathon@users.noreply.github.com

[coderabbitai]

📝 Walkthrough

Walkthrough

After validating symlinks under /sandbox/.openclaw/ point to /sandbox/.openclaw-data/*, the script optionally runs chattr +i (if available) on /sandbox/.openclaw and each symlink to make them immutable, suppressing chattr errors; this runs only after the validation loop completes and as root.

Changes

Cohort / File(s)	Summary
Symlink immutability hardening scripts/nemoclaw-start.sh	After the existing one-shot symlink validation, add an optional post-validation step: if chattr exists, set immutable attribute (chattr +i) on /sandbox/.openclaw and each symlink inside it, with failures suppressed (`2>/dev/null

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Poem

🐇 I checked each link, then locked the door,
No sly swaps now can change the core.
Immutable hops keep secrets tight,
Gateway sleeps easy through the night. ✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately describes the main change: making .openclaw symlinks immutable after validation, which directly addresses the TOCTOU vulnerability in issue #1019.
Linked Issues check	✅ Passed	The PR fully addresses #1019's requirements by implementing immutable flag protection via chattr +i on validated symlinks, with graceful degradation when chattr is unavailable, closing the TOCTOU window.
Out of Scope Changes check	✅ Passed	All changes are narrowly scoped to the stated objective: adding post-validation immutable hardening to symlinks in scripts/nemoclaw-start.sh with no unrelated modifications.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[cv]

Nice catch!

[13ernkastel]

I opened a small follow-up PR on top of this branch to tighten the hardening path and make it easier to review operationally: latenighthackathon#1

It adds two things on top of the current fix:

• explicit security logging when immutable hardening is unavailable, partial, or successful
• a gateway-isolation E2E check that fails if \ is missing from the image

The intent is to keep the current defense-in-depth approach while making silent regressions and silent no-op hardening easier to catch.