johan
/
mission-control
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix: stop forcing dangerouslyDisableDeviceAuth + fix exec security value 

- Remove unconditional `dangerouslyDisableDeviceAuth = true` from MC
  origin registration. MC should only add its origin to allowedOrigins,
  not silently downgrade the gateway's device auth security posture.

- Replace invalid `sandbox` value with `allowlist` in security scan
  and auto-fix for `tools.exec.security`. Current OpenClaw validates
  only: deny, allowlist, full. The old `sandbox` value was rejected.

Closes #357, closes #356
This commit is contained in:
nyk 2026-03-14 21:44:11 +07:00 committed by GitHub
parent 3525c4543f
commit 2449363868
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
3 changed files with 11 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/app/api/security-scan/fix/route.ts
View File

@ -272,10 +272,10 @@ export async function POST(request: NextRequest) {
if (shouldFix('exec_restricted')) {
if (!ocConfig.tools) ocConfig.tools = {}
if (!ocConfig.tools.exec) ocConfig.tools.exec = {}
if (ocConfig.tools.exec.security !== 'sandbox' && ocConfig.tools.exec.security !== 'deny') {
ocConfig.tools.exec.security = 'sandbox'
if (ocConfig.tools.exec.security !== 'allowlist' && ocConfig.tools.exec.security !== 'deny') {
ocConfig.tools.exec.security = 'allowlist'
configChanged = true
results.push({ id: 'exec_restricted', name: 'Exec tool restriction', fixed: true, detail: 'Set exec security to "sandbox"', fixSafety: FIX_SAFETY['exec_restricted'] })
results.push({ id: 'exec_restricted', name: 'Exec tool restriction', fixed: true, detail: 'Set exec security to "allowlist"', fixSafety: FIX_SAFETY['exec_restricted'] })
}
}

15
src/lib/gateway-runtime.ts
View File

@ -44,19 +44,16 @@ export function registerMcAsDashboard(mcUrl: string): { registered: boolean; alr
const origin = new URL(mcUrl).origin
const origins: string[] = parsed.gateway.controlUi.allowedOrigins || []
const alreadyInOrigins = origins.includes(origin)
const deviceAuthAlreadyDisabled = parsed.gateway.controlUi.dangerouslyDisableDeviceAuth === true
if (alreadyInOrigins && deviceAuthAlreadyDisabled) {
if (alreadyInOrigins) {
return { registered: false, alreadySet: true }
}
// Add MC origin to allowedOrigins and disable device auth
// (MC authenticates via gateway token — device pairing is unnecessary)
if (!alreadyInOrigins) {
origins.push(origin)
parsed.gateway.controlUi.allowedOrigins = origins
}
parsed.gateway.controlUi.dangerouslyDisableDeviceAuth = true
// Add MC origin to allowedOrigins only — do NOT touch dangerouslyDisableDeviceAuth.
// MC authenticates via gateway token, but forcing device auth off is a security
// downgrade that the operator should control, not Mission Control.
origins.push(origin)
parsed.gateway.controlUi.allowedOrigins = origins
fs.writeFileSync(configPath, JSON.stringify(parsed, null, 2) + '\n')
logger.info({ origin }, 'Registered MC origin in gateway config')

4
src/lib/security-scan.ts
View File

@ -362,9 +362,9 @@ function scanOpenClaw(): Category {
checks.push({
id: 'exec_restricted',
name: 'Exec tool restricted',
status: execSecurity === 'deny' ? 'pass' : execSecurity === 'sandbox' ? 'pass' : 'warn',
status: execSecurity === 'deny' ? 'pass' : execSecurity === 'allowlist' ? 'pass' : 'warn',
detail: `Exec security: ${execSecurity || 'default'}`,
fix: execSecurity !== 'deny' && execSecurity !== 'sandbox' ? 'Set tools.exec.security to "deny" or "sandbox"' : '',
fix: execSecurity !== 'deny' && execSecurity !== 'allowlist' ? 'Set tools.exec.security to "deny" or "allowlist"' : '',
severity: 'high',
})