feat(security): audit open ingress control-plane tool exposure (#100965)

hugenshen · steipete · NIO · web-flow · commit 589f1c00de32 · 2026-07-11T12:36:37.000-07:00
* fix(security): audit open control-plane exposure

Co-authored-by: NIO &lt;nocodet@mail.com&gt;

* chore: keep sweep changelog neutral

---------

Co-authored-by: Peter Steinberger &lt;steipete@gmail.com&gt;
Co-authored-by: NIO &lt;nocodet@mail.com&gt;
diff --git a/docs/gateway/security/audit-checks.md b/docs/gateway/security/audit-checks.md
@@ -128,6 +128,7 @@ exhaustive):
 | `security.exposure.open_channels_with_exec`                     | warn/critical      | Shared/public rooms can reach exec-enabled agents                                       | `channels.*.dmPolicy`, `channels.*.groupPolicy`, `tools.exec.*`, `agents.list[].tools.exec.*`        | no       |
 | `security.exposure.open_groups_with_elevated`                   | critical           | Open DMs/groups + elevated tools create high-impact prompt-injection paths              | top-level or nested DM policy paths, account overrides, `channels.*.groupPolicy`                     | no       |
 | `security.exposure.open_groups_with_runtime_or_fs`              | critical/warn      | Open DMs/groups can reach command/file tools without sandbox/workspace guards           | DM/group policy paths, `tools.profile/deny`, `tools.fs.workspaceOnly`, `agents.*.sandbox.mode`       | no       |
+| `security.exposure.open_groups_with_control_plane_tools`        | critical           | Open DMs/groups can reach gateway/cron control-plane tools                              | DM/group policy paths, `tools.allow`, `tools.alsoAllow`, `tools.profile`, `gateway`, `cron`          | no       |
 | `security.trust_model.multi_user_heuristic`                     | warn               | Config looks multi-user while gateway trust model is personal-assistant                 | split trust boundaries, or shared-user hardening (`sandbox.mode`, tool deny/workspace scoping)       | no       |
 | `tools.profile_minimal_overridden`                              | warn               | Agent overrides bypass global minimal profile                                           | `agents.list[].tools.profile`                                                                        | no       |
 | `plugins.tools_reachable_permissive_policy`                     | warn               | Extension tools reachable in permissive contexts                                        | `tools.profile` + tool allow/deny                                                                    | no       |
diff --git a/src/agents/agent-tools.policy.ts b/src/agents/agent-tools.policy.ts
@@ -155,7 +155,10 @@ export function resolveConfiguredToolPolicies(params: {
 }): SandboxToolPolicy[] {
   const policies: SandboxToolPolicy[] = [];
   const profile = params.agentTools?.profile ?? params.cfg.tools?.profile;
-  const profilePolicy = resolveToolProfilePolicy(profile);
+  const profileAlsoAllow =
+    resolveExplicitProfileAlsoAllow(params.agentTools) ??
+    resolveExplicitProfileAlsoAllow(params.cfg.tools);
+  const profilePolicy = mergeAlsoAllowPolicy(resolveToolProfilePolicy(profile), profileAlsoAllow);
   if (profilePolicy) {
     policies.push(profilePolicy);
   }
diff --git a/src/security/audit-extra.sync.ts b/src/security/audit-extra.sync.ts
@@ -5,14 +5,11 @@ import {
   normalizeStringifiedOptionalString,
 } from "@openclaw/normalization-core/string-coerce";
 import { normalizeUniqueStringEntries } from "@openclaw/normalization-core/string-normalization";
-import { pickSandboxToolPolicy } from "../agents/sandbox-tool-policy.js";
+import { resolveConfiguredToolPolicies } from "../agents/agent-tools.policy.js";
 import { resolveSandboxConfigForAgent } from "../agents/sandbox/config.js";
 import { isDangerousNetworkMode, normalizeNetworkMode } from "../agents/sandbox/network-mode.js";
-import { resolveSandboxToolPolicyForAgent } from "../agents/sandbox/tool-policy.js";
-import type { SandboxToolPolicy } from "../agents/sandbox/types.js";
 import { getBlockedBindReason } from "../agents/sandbox/validate-sandbox-security.js";
 import { isToolAllowedByPolicies } from "../agents/tool-policy-match.js";
-import { resolveToolProfilePolicy } from "../agents/tool-policy.js";
 import { formatCliCommand } from "../cli/command-format.js";
 import type { GatewayAuthConfig } from "../config/types.gateway.js";
 import type { OpenClawConfig } from "../config/types.openclaw.js";
@@ -25,6 +22,7 @@ import {
   resolveNodeCommandAllowlist,
 } from "../gateway/node-command-policy.js";
 import { collectAuditModelRefs } from "./audit-model-refs.js";
+import { GATEWAY_CONTROL_PLANE_TOOLS } from "./dangerous-tools.js";
 
 /**
  * Synchronous security audit collector functions.
@@ -279,36 +277,6 @@ function listKnownNodeCommands(cfg: OpenClawConfig): Set<string> {
   return out;
 }
 
-function resolveToolPolicies(params: {
-  cfg: OpenClawConfig;
-  agentTools?: AgentToolsConfig;
-  sandboxMode?: "off" | "non-main" | "all";
-  agentId?: string | null;
-}): SandboxToolPolicy[] {
-  const policies: SandboxToolPolicy[] = [];
-  const profile = params.agentTools?.profile ?? params.cfg.tools?.profile;
-  const profilePolicy = resolveToolProfilePolicy(profile);
-  if (profilePolicy) {
-    policies.push(profilePolicy);
-  }
-
-  const globalPolicy = pickSandboxToolPolicy(params.cfg.tools ?? undefined);
-  if (globalPolicy) {
-    policies.push(globalPolicy);
-  }
-
-  const agentPolicy = pickSandboxToolPolicy(params.agentTools);
-  if (agentPolicy) {
-    policies.push(agentPolicy);
-  }
-
-  if (params.sandboxMode === "all") {
-    policies.push(resolveSandboxToolPolicyForAgent(params.cfg, params.agentId ?? undefined));
-  }
-
-  return policies;
-}
-
 function looksLikeNodeCommandPattern(value: string): boolean {
   if (!value) {
     return false;
@@ -500,15 +468,14 @@ function listPotentialMultiUserSignals(cfg: OpenClawConfig): string[] {
   return Array.from(out);
 }
 
-function collectRiskyToolExposureContexts(cfg: OpenClawConfig): {
-  riskyContexts: string[];
-  hasRuntimeRisk: boolean;
-} {
-  const contexts: Array<{
-    label: string;
-    agentId?: string;
-    tools?: AgentToolsConfig;
-  }> = [{ label: "agents.defaults" }];
+type AuditAgentToolContext = {
+  label: string;
+  agentId?: string;
+  tools?: AgentToolsConfig;
+};
+
+function listAuditAgentToolContexts(cfg: OpenClawConfig): AuditAgentToolContext[] {
+  const contexts: AuditAgentToolContext[] = [{ label: "agents.defaults" }];
   for (const agent of cfg.agents?.list ?? []) {
     if (!agent || typeof agent !== "object" || typeof agent.id !== "string") {
       continue;
@@ -519,12 +486,18 @@ function collectRiskyToolExposureContexts(cfg: OpenClawConfig): {
       tools: agent.tools,
     });
   }
+  return contexts;
+}
 
+function collectRiskyToolExposureContexts(cfg: OpenClawConfig): {
+  riskyContexts: string[];
+  hasRuntimeRisk: boolean;
+} {
   const riskyContexts: string[] = [];
   let hasRuntimeRisk = false;
-  for (const context of contexts) {
+  for (const context of listAuditAgentToolContexts(cfg)) {
     const sandboxMode = resolveSandboxConfigForAgent(cfg, context.agentId).mode;
-    const policies = resolveToolPolicies({
+    const policies = resolveConfiguredToolPolicies({
       cfg,
       agentTools: context.tools,
       sandboxMode,
@@ -555,6 +528,30 @@ function collectRiskyToolExposureContexts(cfg: OpenClawConfig): {
   return { riskyContexts, hasRuntimeRisk };
 }
 
+function collectControlPlaneToolExposureContexts(cfg: OpenClawConfig): string[] {
+  const exposedContexts: string[] = [];
+  for (const context of listAuditAgentToolContexts(cfg)) {
+    const sandboxMode = resolveSandboxConfigForAgent(cfg, context.agentId).mode;
+    const policies = resolveConfiguredToolPolicies({
+      cfg,
+      agentTools: context.tools,
+      sandboxMode,
+      agentId: context.agentId ?? null,
+    });
+    const controlPlaneTools = GATEWAY_CONTROL_PLANE_TOOLS.filter((tool) =>
+      isToolAllowedByPolicies(tool, policies),
+    );
+    if (controlPlaneTools.length === 0) {
+      continue;
+    }
+    const profile = context.tools?.profile ?? cfg.tools?.profile ?? "none";
+    exposedContexts.push(
+      `${context.label} (profile=${profile}; controlPlane=[${controlPlaneTools.join(", ")}])`,
+    );
+  }
+  return exposedContexts;
+}
+
 // --------------------------------------------------------------------------
 // Exported collectors
 // --------------------------------------------------------------------------
@@ -1208,6 +1205,21 @@ export function collectExposureMatrixFindings(cfg: OpenClawConfig): SecurityAudi
     });
   }
 
+  const controlPlaneContexts = collectControlPlaneToolExposureContexts(cfg);
+  if (controlPlaneContexts.length > 0) {
+    findings.push({
+      checkId: "security.exposure.open_groups_with_control_plane_tools",
+      severity: "critical",
+      title: "Open group/DM policy with gateway/cron control-plane tools exposed",
+      detail:
+        `Found inbound policy="open" at:\n${openInboundPolicies.map((p) => `- ${p}`).join("\n")}\n` +
+        `Control-plane tool exposure contexts:\n${controlPlaneContexts.map((line) => `- ${line}`).join("\n")}\n` +
+        "Prompt injection in open conversations can trigger persistent gateway config changes or scheduled automation.",
+      remediation:
+        'For open groups or DMs, deny control-plane tools (`gateway`, `cron`) and prefer tools.profile="messaging". Tighten dmPolicy/groupPolicy to pairing or allowlist when possible.',
+    });
+  }
+
   return findings;
 }
 
diff --git a/src/security/audit-trust-model.test.ts b/src/security/audit-trust-model.test.ts
@@ -231,6 +231,124 @@ describe("security audit trust model findings", () => {
           ).toBe(false);
         },
       },
+      {
+        name: "flags open groupPolicy when coding profile exposes cron",
+        cfg: {
+          channels: { whatsapp: { groupPolicy: "open" } },
+          tools: { elevated: { enabled: false }, profile: "coding" },
+        } satisfies OpenClawConfig,
+        assert: (findings: ReturnType<typeof audit>) => {
+          const finding = findings.find(
+            (entry) => entry.checkId === "security.exposure.open_groups_with_control_plane_tools",
+          );
+          expect(finding?.severity).toBe("critical");
+          expect(finding?.detail).toContain("channels.whatsapp.groupPolicy");
+          expect(finding?.detail).toContain("controlPlane=[cron]");
+          expect(finding?.detail).not.toContain("controlPlane=[gateway, cron]");
+        },
+      },
+      {
+        name: "flags open dmPolicy when gateway is explicitly allowed",
+        cfg: {
+          channels: { slack: { dmPolicy: "open" } },
+          tools: { elevated: { enabled: false }, allow: ["gateway"] },
+        } satisfies OpenClawConfig,
+        assert: (findings: ReturnType<typeof audit>) => {
+          const finding = findings.find(
+            (entry) => entry.checkId === "security.exposure.open_groups_with_control_plane_tools",
+          );
+          expect(finding?.severity).toBe("critical");
+          expect(finding?.detail).toContain("channels.slack.dmPolicy");
+          expect(finding?.detail).toContain("controlPlane=[gateway]");
+        },
+      },
+      {
+        name: "flags global alsoAllow that widens a restrictive profile",
+        cfg: {
+          channels: { slack: { dmPolicy: "open" } },
+          tools: {
+            elevated: { enabled: false },
+            profile: "messaging",
+            alsoAllow: ["cron"],
+          },
+        } satisfies OpenClawConfig,
+        assert: (findings: ReturnType<typeof audit>) => {
+          const finding = findings.find(
+            (entry) => entry.checkId === "security.exposure.open_groups_with_control_plane_tools",
+          );
+          expect(finding?.detail).toContain(
+            "agents.defaults (profile=messaging; controlPlane=[cron])",
+          );
+        },
+      },
+      {
+        name: "reports per-agent control-plane exposure",
+        cfg: {
+          channels: { whatsapp: { groupPolicy: "open" } },
+          tools: { elevated: { enabled: false }, profile: "messaging" },
+          agents: {
+            list: [{ id: "ops", tools: { profile: "messaging", alsoAllow: ["gateway"] } }],
+          },
+        } satisfies OpenClawConfig,
+        assert: (findings: ReturnType<typeof audit>) => {
+          const finding = findings.find(
+            (entry) => entry.checkId === "security.exposure.open_groups_with_control_plane_tools",
+          );
+          expect(finding?.detail).toContain(
+            "agents.list.ops (profile=messaging; controlPlane=[gateway])",
+          );
+          expect(finding?.detail).not.toContain("agents.defaults (profile=messaging");
+        },
+      },
+      {
+        name: "does not flag control-plane exposure when gateway and cron are denied",
+        cfg: {
+          channels: { whatsapp: { groupPolicy: "open" } },
+          tools: {
+            elevated: { enabled: false },
+            profile: "coding",
+            deny: ["gateway", "cron"],
+          },
+        } satisfies OpenClawConfig,
+        assert: (findings: ReturnType<typeof audit>) => {
+          expect(
+            findings.some(
+              (finding) =>
+                finding.checkId === "security.exposure.open_groups_with_control_plane_tools",
+            ),
+          ).toBe(false);
+        },
+      },
+      {
+        name: "does not classify other owner-only tools as control-plane exposure",
+        cfg: {
+          channels: { whatsapp: { groupPolicy: "open" } },
+          tools: { elevated: { enabled: false }, allow: ["nodes", "computer"] },
+        } satisfies OpenClawConfig,
+        assert: (findings: ReturnType<typeof audit>) => {
+          expect(
+            findings.some(
+              (finding) =>
+                finding.checkId === "security.exposure.open_groups_with_control_plane_tools",
+            ),
+          ).toBe(false);
+        },
+      },
+      {
+        name: "does not flag control-plane exposure when inbound policy is not open",
+        cfg: {
+          channels: { whatsapp: { groupPolicy: "allowlist" } },
+          tools: { elevated: { enabled: false }, profile: "coding" },
+        } satisfies OpenClawConfig,
+        assert: (findings: ReturnType<typeof audit>) => {
+          expect(
+            findings.some(
+              (finding) =>
+                finding.checkId === "security.exposure.open_groups_with_control_plane_tools",
+            ),
+          ).toBe(false);
+        },
+      },
     ] as const;
 
     for (const testCase of cases) {
diff --git a/src/security/dangerous-tools.ts b/src/security/dangerous-tools.ts
@@ -35,9 +35,19 @@ export const DEFAULT_GATEWAY_HTTP_TOOL_DENY = [
   "computer",
 ] as const;
 
+/**
+ * Persistent control-plane tools that can change Gateway configuration or
+ * create scheduled automation.
+ */
+export const GATEWAY_CONTROL_PLANE_TOOLS = ["cron", "gateway"] as const;
+
 /**
  * Core tools that require sender owner identity on Gateway-scoped surfaces.
  * `gateway.tools.allow` can remove the default HTTP deny only for owner/trusted-operator
  * callers; non-owner identity-bearing callers must not receive server-credential wrappers.
  */
-export const GATEWAY_OWNER_ONLY_CORE_TOOLS = ["cron", "gateway", "nodes", "computer"] as const;
+export const GATEWAY_OWNER_ONLY_CORE_TOOLS = [
+  ...GATEWAY_CONTROL_PLANE_TOOLS,
+  "nodes",
+  "computer",
+] as const;
