@@ -18,14 +18,15 @@ report drift through `doctor --lint`. The final conformance signal is a clean
1818instead of creating a separate health gate.
19192020Policy currently manages configured channels, MCP servers, model providers,
21-network SSRF posture, OpenClaw config secret provider/auth profile posture,
22-and governed tool declarations. For example, IT or a workspace operator can
23-record that Telegram is not an approved channel provider, restrict MCP servers
24-and model refs to approved entries, require private-network fetch/browser
25-access to remain disabled, require OpenClaw config SecretRefs to use managed
26-providers, require config auth profiles to carry provider/mode metadata,
27-require governed tools to carry risk and sensitivity metadata, then use
28-`doctor --lint` as the shared conformance gate.
21+network SSRF posture, Gateway exposure posture, OpenClaw config secret
22+provider/auth profile posture, and governed tool declarations. For example, IT
23+or a workspace operator can record that Telegram is not an approved channel
24+provider, restrict MCP servers and model refs to approved entries, require
25+private-network fetch/browser access to remain disabled, require Gateway
26+bind/auth/HTTP exposure to stay within reviewed bounds, require OpenClaw config
27+SecretRefs to use managed providers, require config auth profiles to carry
28+provider/mode metadata, require governed tools to carry risk and sensitivity
29+metadata, then use `doctor --lint` as the shared conformance gate.
29303031Use policy when a workspace needs a durable statement such as "these channels
3132must not be enabled" or "governed tools must declare approval metadata" and a
@@ -46,9 +47,9 @@ arbitrary plugins. The plugin remains enabled if `policy.jsonc` is missing, so
4647doctor can report the missing artifact.
47484849Policy is authored, not generated from the user's current settings. A minimal
49-policy for channels, MCP servers, model providers, network posture,
50-OpenClaw config secret provider/auth profile posture, and tool metadata looks
51-like this:
50+policy for channels, MCP servers, model providers, network posture, Gateway
51+exposure, OpenClaw config secret provider/auth profile posture, and tool
52+metadata looks like this:
52535354```jsonc
5455{
@@ -78,6 +79,26 @@ like this:
7879"allow": false,
7980 },
8081 },
82+"gateway": {
83+"exposure": {
84+"allowNonLoopbackBind": false,
85+"allowTailscaleFunnel": false,
86+ },
87+"auth": {
88+"requireAuth": true,
89+"requireExplicitRateLimit": true,
90+ },
91+"controlUi": {
92+"allowInsecure": false,
93+ },
94+"remote": {
95+"allow": false,
96+ },
97+"http": {
98+"denyEndpoints": ["chatCompletions", "responses"],
99+"requireUrlAllowlists": true,
100+ },
101+ },
81102"secrets": {
82103"requireManagedProviders": true,
83104"denySources": ["exec"],
@@ -98,12 +119,15 @@ like this:
98119The rules are the authority. A category block is only a namespace; checks run
99120when a concrete rule is present. OpenClaw reads current `channels.*` settings
100121`mcp.servers.*`, `models.providers.*`, selected agent model refs, network SSRF
101-settings, OpenClaw config secret provider and SecretRef provenance, config auth
102-profile metadata, and `TOOLS.md` declarations as evidence, then reports
103-observed state that does not conform. Secret evidence records provider/source
104-posture and SecretRef metadata, never raw secret values. Policy does not read
105-or attest per-agent credential stores such as `auth-profiles.json`; those
106-stores remain owned by the existing auth and credential flows.
122+settings, Gateway bind/auth/Control UI/Tailscale/remote/HTTP posture, OpenClaw
123+config secret provider and SecretRef provenance, config auth profile metadata,
124+and `TOOLS.md` declarations as evidence, then reports observed state that does
125+not conform. If a policy denies non-loopback Gateway binds, omit `gateway.bind`
126+only when you are willing to review the runtime default; set
127+`gateway.bind=loopback` for strict config conformance. Secret evidence records
128+provider/source posture and SecretRef metadata, never raw secret values. Policy
129+does not read or attest per-agent credential stores such as `auth-profiles.json`;
130+those stores remain owned by the existing auth and credential flows.
107131108132Run policy-only checks during authoring:
109133@@ -236,6 +260,16 @@ Example JSON output:
236260"value": false
237261 }
238262 ],
263+"gatewayExposure": [
264+ {
265+"id": "gateway-bind",
266+"kind": "bind",
267+"source": "oc://openclaw.config/gateway/bind",
268+"value": "loopback",
269+"nonLoopback": false,
270+"explicit": true
271+ }
272+ ],
239273"secrets": [
240274 {
241275"id": "vault",
@@ -272,7 +306,7 @@ Example JSON output:
272306 }
273307 ]
274308 },
275-"checksRun": 20,
309+"checksRun": 28,
276310"checksSkipped": 0,
277311"findings": []
278312}
@@ -320,28 +354,36 @@ choose a different interval.
320354321355Policy currently verifies:
322356323-| Check id | Finding |
324-| ---------------------------------------- | -------------------------------------------------------------------------------- |
325-| `policy/policy-jsonc-missing` | Policy is enabled but `policy.jsonc` is missing. |
326-| `policy/policy-jsonc-invalid` | Policy cannot be parsed or contains malformed rule entries. |
327-| `policy/policy-hash-mismatch` | Policy does not match configured `expectedHash`. |
328-| `policy/attestation-hash-mismatch` | Current policy evidence no longer matches the accepted attestation. |
329-| `policy/channels-denied-provider` | An enabled channel matches a channel deny rule. |
330-| `policy/mcp-denied-server` | A configured MCP server is denied by policy. |
331-| `policy/mcp-unapproved-server` | A configured MCP server is outside the allowlist. |
332-| `policy/models-denied-provider` | A configured model provider or model ref uses a denied provider. |
333-| `policy/models-unapproved-provider` | A configured model provider or model ref is outside the allowlist. |
334-| `policy/network-private-access-enabled` | A private-network SSRF escape hatch is enabled when policy denies it. |
335-| `policy/secrets-unmanaged-provider` | A config SecretRef references a provider not declared under `secrets.providers`. |
336-| `policy/secrets-denied-provider-source` | A config secret provider or SecretRef uses a source denied by policy. |
337-| `policy/secrets-insecure-provider` | A secret provider opts into insecure posture when policy denies it. |
338-| `policy/auth-profile-invalid-metadata` | A config auth profile is missing valid provider or mode metadata. |
339-| `policy/auth-profile-unapproved-mode` | A config auth profile mode is outside the policy allowlist. |
340-| `policy/tools-missing-risk-level` | A governed tool declaration is missing risk metadata. |
341-| `policy/tools-unknown-risk-level` | A governed tool declaration uses an unknown risk value. |
342-| `policy/tools-missing-sensitivity-token` | A governed tool declaration is missing sensitivity metadata. |
343-| `policy/tools-missing-owner` | A governed tool declaration is missing owner metadata. |
344-| `policy/tools-unknown-sensitivity-token` | A governed tool declaration uses an unknown sensitivity value. |
357+| Check id | Finding |
358+| -------------------------------------------- | -------------------------------------------------------------------------------- |
359+| `policy/policy-jsonc-missing` | Policy is enabled but `policy.jsonc` is missing. |
360+| `policy/policy-jsonc-invalid` | Policy cannot be parsed or contains malformed rule entries. |
361+| `policy/policy-hash-mismatch` | Policy does not match configured `expectedHash`. |
362+| `policy/attestation-hash-mismatch` | Current policy evidence no longer matches the accepted attestation. |
363+| `policy/channels-denied-provider` | An enabled channel matches a channel deny rule. |
364+| `policy/mcp-denied-server` | A configured MCP server is denied by policy. |
365+| `policy/mcp-unapproved-server` | A configured MCP server is outside the allowlist. |
366+| `policy/models-denied-provider` | A configured model provider or model ref uses a denied provider. |
367+| `policy/models-unapproved-provider` | A configured model provider or model ref is outside the allowlist. |
368+| `policy/network-private-access-enabled` | A private-network SSRF escape hatch is enabled when policy denies it. |
369+| `policy/gateway-non-loopback-bind` | Gateway bind posture permits non-loopback exposure when policy denies it. |
370+| `policy/gateway-auth-disabled` | Gateway authentication is disabled when policy requires auth. |
371+| `policy/gateway-rate-limit-missing` | Gateway auth rate-limit posture is not explicit when policy requires it. |
372+| `policy/gateway-control-ui-insecure` | Gateway Control UI insecure exposure toggles are enabled. |
373+| `policy/gateway-tailscale-funnel` | Gateway Tailscale Funnel exposure is enabled when policy denies it. |
374+| `policy/gateway-remote-enabled` | Gateway remote mode is active when policy denies it. |
375+| `policy/gateway-http-endpoint-enabled` | A Gateway HTTP API endpoint is enabled while denied by policy. |
376+| `policy/gateway-http-url-fetch-unrestricted` | Gateway HTTP URL-fetch input lacks a required URL allowlist. |
377+| `policy/secrets-unmanaged-provider` | A config SecretRef references a provider not declared under `secrets.providers`. |
378+| `policy/secrets-denied-provider-source` | A config secret provider or SecretRef uses a source denied by policy. |
379+| `policy/secrets-insecure-provider` | A secret provider opts into insecure posture when policy denies it. |
380+| `policy/auth-profile-invalid-metadata` | A config auth profile is missing valid provider or mode metadata. |
381+| `policy/auth-profile-unapproved-mode` | A config auth profile mode is outside the policy allowlist. |
382+| `policy/tools-missing-risk-level` | A governed tool declaration is missing risk metadata. |
383+| `policy/tools-unknown-risk-level` | A governed tool declaration uses an unknown risk value. |
384+| `policy/tools-missing-sensitivity-token` | A governed tool declaration is missing sensitivity metadata. |
385+| `policy/tools-missing-owner` | A governed tool declaration is missing owner metadata. |
386+| `policy/tools-unknown-sensitivity-token` | A governed tool declaration uses an unknown sensitivity value. |
345387346388Policy findings can include both `target` and `requirement`. `target` is the
347389observed workspace thing that does not conform. `requirement` is the authored
@@ -426,6 +468,21 @@ Example network finding:
426468}
427469```
428470471+Example Gateway exposure finding:
472+473+```json
474+{
475+"checkId": "policy/gateway-non-loopback-bind",
476+"severity": "error",
477+"message": "Gateway bind setting 'gateway-bind' permits non-loopback exposure.",
478+"source": "policy",
479+"path": "openclaw config",
480+"ocPath": "oc://openclaw.config/gateway/bind",
481+"target": "oc://openclaw.config/gateway/bind",
482+"requirement": "oc://policy.jsonc/gateway/exposure/allowNonLoopbackBind"
483+}
484+```
485+429486## Repair
430487431488`doctor --lint` and `policy check` are read-only.
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。