ewilliams28/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-08-12 21:53:00 -06:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): stop recommending retired install-policy bypasses (#120011)

Browse Source 
* fix(security): align install policy path contract

* test(security): align install policy wording

* style(security): format install policy test

* fix(security): identify failing install policy path

* test(security): track Windows ACL temp dirs
This commit is contained in:
Peter Steinberger
2026-08-06 18:45:18 -07:00
committed by GitHub
parent b8b878ed33
commit 804ae7f121
6 changed files with 133 additions and 82 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/tools/skills-config.md
+3 -10
View File
@@ -168,16 +168,9 @@ skills, skill dependency installers, and plugin install/update sources.
Optional allowlist of directories that may contain the policy executable.
</ParamField>
<ParamField path="security.installPolicy.exec.allowInsecurePath" type="boolean" default="false">
Bypasses command path ownership and permission checks. Use only when the
path is protected by another mechanism.
</ParamField>
<ParamField path="security.installPolicy.exec.allowSymlinkCommand" type="boolean" default="false">
Allows the configured command path to be a symlink. The resolved target
must still satisfy the other path checks. Interpreter script arguments must
be direct regular files, not symlinks.
</ParamField>
The policy command and interpreter script arguments must be direct regular
files with trusted ownership, restricted permissions, and verifiable parent
directories. Symlinks and insecure paths are rejected.
The policy receives one JSON object on stdin with `protocolVersion: 1`,
`openclawVersion`, `targetType`, `targetName`, `sourcePath`, `sourcePathKind`,