设置配置文件权限（仅管理员可写）

openclaw AI小龙虾攻略 2026-04-09 1

OpenClaw 权限设置通常涉及以下几个关键方面：

设置配置文件权限（仅管理员可写）-第1张图片-官方获取 | OpenClaw下载 - openclaw官网

基础权限配置

配置文件权限

chown root:root /etc/openclaw/config.yaml

日志文件权限

# 创建日志目录并设置权限
mkdir -p /var/log/openclaw
chmod 755 /var/log/openclaw
chown openclaw:openclaw /var/log/openclaw

用户和组管理

# 创建专用用户和组
sudo groupadd openclaw
sudo useradd -r -g openclaw -s /bin/false openclaw
# 检查用户权限
id openclaw

Docker 容器权限

Docker 运行权限

# Dockerfile 示例
FROM python:3.9-slim
RUN groupadd -r openclaw && useradd -r -g openclaw openclaw
USER openclaw

Docker Compose 配置

version: '3'
services:
  openclaw:
    image: openclaw:latest
    user: "1000:1000"  # 使用非root用户
    volumes:
      - ./data:/data:rw
      - ./config:/config:ro

Linux 能力设置

# 限制权限，仅授予必要的能力
sudo setcap 'cap_net_raw+ep' /usr/bin/openclaw
sudo setcap 'cap_net_admin+ep' /usr/bin/openclaw
# 移除不必要的权限
sudo setcap -r /usr/bin/openclaw

SELinux/AppArmor 配置

AppArmor 配置文件

# /etc/apparmor.d/openclaw
#include <tunables/global>
profile openclaw /usr/bin/openclaw {
  #include <abstractions/base>
  # 允许网络访问
  network inet tcp,
  network inet udp,
  # 文件访问权限
  /etc/openclaw/* r,
  /var/log/openclaw/* rw,
  /tmp/openclaw-* rw,
  # 拒绝其他访问
  deny /root/** rw,
  deny /etc/shadow r,
}

文件系统权限最佳实践

# 推荐目录结构权限
/opt/openclaw/
├── bin/              # 755 (root:root)
├── config/           # 750 (openclaw:openclaw)
├── logs/             # 770 (openclaw:openclaw)
├── data/             # 770 (openclaw:openclaw)
└── plugins/          # 755 (root:root)
# 设置权限脚本
#!/bin/bash
OPENCLAW_DIR="/opt/openclaw"
# 设置目录权限
find $OPENCLAW_DIR -type d -exec chmod 750 {} \;
find $OPENCLAW_DIR -type f -exec chmod 640 {} \;
# 可执行文件特殊权限
chmod 750 $OPENCLAW_DIR/bin/*
# 日志目录可写
chmod 770 $OPENCLAW_DIR/logs

网络权限控制

# 使用iptables限制访问
sudo iptables -A OUTPUT -m owner --uid-owner openclaw -j ACCEPT
sudo iptables -A OUTPUT -m owner --uid-owner openclaw -d 192.168.1.0/24 -j ACCEPT
# 或者使用firewalld
sudo firewall-cmd --zone=public --add-rich-rule='
  rule family="ipv4"
  source address="192.168.1.0/24"
  port protocol="tcp" port="8080" accept'

Systemd 服务配置

# /etc/systemd/system/openclaw.service
[Unit]
Description=OpenClaw Security Scanner
After=network.target
[Service]
Type=simple
User=openclaw
Group=openclaw
WorkingDirectory=/opt/openclaw
ExecStart=/opt/openclaw/bin/openclaw
Restart=on-failure
# 安全加固选项
NoNewPrivileges=yes
PrivateTmp=yes
ProtectSystem=strict
ReadWritePaths=/var/log/openclaw /opt/openclaw/data
PrivateDevices=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectControlGroups=yes
[Install]
WantedBy=multi-user.target

API 权限管理

# API权限示例（如适用）
permissions = {
    "admin": ["scan:*", "config:*", "users:*"],
    "operator": ["scan:read", "scan:create", "results:read"],
    "viewer": ["scan:read", "results:read"],
}
# JWT token验证
def verify_token(token, required_permission):
    # 验证逻辑
    pass

定期审计

# 审计脚本示例
#!/bin/bash
echo "=== OpenClaw权限审计 ==="
echo "1. 用户权限检查:"
ps aux | grep openclaw
echo ""
echo "2. 文件权限检查:"
ls -la /opt/openclaw/
echo ""
echo "3. 网络连接检查:"
netstat -tulpn | grep openclaw