Description

Description

OpenShell 0.0.26 receives correct filesystem_policy from NemoClaw (include_workdir: false, /sandbox in read_only) but does not apply Landlock ruleset to sandbox process. /sandbox is writable on all tested platforms.

Reproduction Steps

1. nemoclaw onboard (any platform, any provider)
2. nemoclaw connect
3. touch /sandbox/testfile
4. echo "test" > /sandbox/testfile
5. cat /sandbox/testfile

Actual Result

Step 3-5: All succeed. File created and written in /sandbox.
/proc/1/attr/current = "unconfined" (no Landlock applied to process)

Expected Result

Step 3: Permission denied (/sandbox is Landlock read-only)

Root Cause
nemoclaw status --json confirms policy is correctly delivered:
filesystem_policy:
include_workdir: false
read_only:
- /sandbox
- /sandbox/.openclaw
read_write:
- /tmp
- /sandbox/.openclaw-data
- /sandbox/.nemoclaw
landlock:
compatibility: best_effort

OpenShell receives the policy but does not apply Landlock ruleset.

Impact:

• Agents can create/modify arbitrary files in /sandbox home directory
• NemoClaw onboard summary displays "Landlock + seccomp + netns"
  which is misleading — Landlock is not enforced
• PR fix(sandbox): restrict /sandbox to read-only via Landlock (#804) #1121 (restrict /sandbox to read-only) is ineffective

Environment:NemoClaw: v0.0.11
OpenShell: 0.0.26
Affected platforms: ALL

• Brev GPU (kernel 5.15.0-107, kernel 6.8.0-57)
• Standard Ubuntu (kernel 6.8.0-57)
• Landlock compiled (CONFIG_SECURITY_LANDLOCK=y)
• Landlock in LSM (lockdown,capability,landlock,yama,apparmor)

Bug Details

[NVB# 6066573]

[NVB#6066573]