mirror of
https://github.com/HKUDS/OpenSpace.git
synced 2026-09-24 00:55:36 +00:00
0711cfd7fa
Changes: - Disable telemetry by default (opt-in instead of opt-out) - Strip user query text and LLM response text from telemetry events - Remove server_identifiers and tools_available_names from telemetry - Default search_scope to 'local' (no auto-import of unverified cloud skills) - Default auto_import to False in search_skills - Scope OpenClaw credential reading to openspace env block only - Enable sandbox by default in security config - Add SECURITY.md with guidance for users See PR description for full security audit findings.
68 lines
1.9 KiB
JSON
68 lines
1.9 KiB
JSON
{
|
|
"security_policies": {
|
|
"global": {
|
|
"allow_shell_commands": true,
|
|
"allow_network_access": true,
|
|
"allow_file_access": true,
|
|
"blocked_commands": {
|
|
"common": ["rm", "-rf", "shutdown", "reboot", "poweroff", "halt"],
|
|
"linux": ["mkfs", "dd", "iptables", "systemctl", "init", "kill", "-9", "pkill"],
|
|
"darwin": ["diskutil", "dd", "pfctl", "launchctl", "killall"],
|
|
"windows": ["del", "format", "rd", "rmdir", "/s", "/q", "taskkill", "/f"]
|
|
},
|
|
"sandbox_enabled": true
|
|
},
|
|
"backend": {
|
|
"shell": {
|
|
"allow_shell_commands": true,
|
|
"allow_file_access": true,
|
|
"blocked_commands": {
|
|
"common": ["rm", "-rf", "shutdown", "reboot", "poweroff", "halt"],
|
|
"linux": [
|
|
"mkfs", "mkfs.ext4", "mkfs.xfs",
|
|
"dd",
|
|
"iptables", "ip6tables", "nftables",
|
|
"systemctl", "service",
|
|
"fdisk", "parted", "gdisk",
|
|
"mount", "umount",
|
|
"chmod", "777",
|
|
"chown", "root",
|
|
"passwd",
|
|
"useradd", "userdel", "usermod",
|
|
"kill", "-9", "pkill", "killall"
|
|
],
|
|
"darwin": [
|
|
"diskutil",
|
|
"dd",
|
|
"pfctl",
|
|
"launchctl",
|
|
"dscl",
|
|
"chmod", "777",
|
|
"chown", "root",
|
|
"passwd",
|
|
"killall",
|
|
"pmset"
|
|
],
|
|
"windows": [
|
|
"del", "erase",
|
|
"format",
|
|
"rd", "rmdir", "/s", "/q",
|
|
"diskpart",
|
|
"reg", "delete",
|
|
"net", "user",
|
|
"taskkill", "/f",
|
|
"wmic"
|
|
]
|
|
},
|
|
"sandbox_enabled": false
|
|
},
|
|
"mcp": {
|
|
"sandbox_enabled": false
|
|
},
|
|
"web": {
|
|
"allow_network_access": true,
|
|
"allowed_domains": []
|
|
}
|
|
}
|
|
}
|
|
}
|