OpenClaw 安全路线图：给能动手的 AI 助手套上缰绳

# openclaw-security-policy.yaml
# 放在助手配置目录下，启动时自动加载

assistant:
  name: openclaw
  version: "0.9.0"

filesystem:
  # 允许读写的目录白名单，支持 glob 模式
  allow_paths:
    - "/home/user/projects/**"
    - "/tmp/openclaw-workspace/**"
  # 禁止触碰的路径，即使白名单内也会被排除
  deny_paths:
    - "/home/user/projects/.env"
    - "/home/user/projects/**/secrets.*"
  # 操作分级策略
  read:  auto        # 自动放行
  write: confirm     # 需用户确认
  delete: audit_log  # 记录审计日志后放行，高危目录需二次确认
  delete_high_risk:
    - "/home/user/projects/**/database/**"
    action: block    # 直接拒绝

command:
  # 允许执行的命令白名单
  allow_commands:
    - "ls"
    - "cat"
    - "grep"
    - "python3"
    - "git"
    - "npm"
  # 禁止执行的命令（即使白名单内也排除）
  deny_commands:
    - "rm -rf"
    - "sudo"
    - "chmod 777"
  # 沙箱参数
  sandbox:
    network: restricted    # 限制网络访问
    max_execution_time: 30 # 单次命令最长 30 秒
    max_memory_mb: 512     # 内存上限

network:
  # 出站请求允许的目标
  allow_domains:
    - "api.github.com"
    - "pypi.org"
    - "registry.npmjs.org"
  deny_domains:
    - "*"                  # 默认拒绝所有，白名单优先
  allow_ports:
    - 443
    - 80

plugin:
  # 每个插件必须声明权限，运行时强制遵守
  require_permission_declaration: true
  # 安装时需要用户审批
  install_requires_approval: true

audit:
  # 审计日志存储路径
  log_path: "/home/user/.openclaw/audit.jsonl"
  # 日志不可篡改（追加写入，文件权限 0440）
  immutable: true
  # 关键操作支持回滚
  rollback_enabled: true
  rollback_snapshot_path: "/home/user/.openclaw/snapshots"

import yaml
from pathlib import Path
from fnmatch import fnmatch

def load_policy(path: str = "openclaw-security-policy.yaml") -> dict:
    with open(path) as f:
        return yaml.safe_load(f)

def check_file_access(policy: dict, filepath: str, action: str) -> bool:
    """检查文件操作是否被策略允许"""
    fs = policy.get("filesystem", {})
    allow = fs.get("allow_paths", [])
    deny = fs.get("deny_paths", [])

    # 先检查白名单
    in_allow = any(fnmatch(filepath, p) for p in allow)
    if not in_allow:
        print(f"[DENY] {filepath} 不在允许路径内")
        return False

    # 再检查黑名单（黑名单优先）
    in_deny = any(fnmatch(filepath, p) for p in deny)
    if in_deny:
        print(f"[DENY] {filepath} 在禁止路径内")
        return False

    # 检查高危删除
    if action == "delete":
        high_risk = fs.get("delete_high_risk", [])
        for rule in high_risk:
            if fnmatch(filepath, rule["path"] if "path" in rule else rule):
                if rule.get("action") == "block":
                    print(f"[BLOCK] {filepath} 是高危删除目标，直接拒绝")
                    return False

    # 检查操作分级
    action_policy = fs.get(action, "auto")
    if action_policy == "block":
        print(f"[BLOCK] {action} 操作被策略禁止")
        return False
    elif action_policy == "confirm":
        print(f"[CONFIRM] {action} {filepath} 需要用户确认")
        # 实际实现中这里会触发确认流程
        return True  # 假设用户已确认
    elif action_policy == "audit_log":
        print(f"[AUDIT] {action} {filepath} 已记录审计日志")
        return True

    return True

# 快速验证
policy = load_policy()
test_paths = [
    ("/home/user/projects/app/main.py", "read"),
    ("/home/user/projects/app/.env", "read"),
    ("/home/user/projects/app/database/old_data.db", "delete"),
    ("/etc/passwd", "read"),
]

for fp, act in test_paths:
    result = check_file_access(policy, fp, act)
    print(f"  → 结果: {'允许' if result else '拒绝'}\n")