Description

OPENCLAW_HOME (used as the “trusted approvals root”) is expanded into the approvals file path, and ensureDir() attempts to prevent symlink traversal by calling assertNoSymlinkPathComponents(dir, resolveRequiredHomeDir()).

However, after the change, assertNoSymlinkPathComponents() no longer lstat-checks the root itself, allowing the trusted root (OPENCLAW_HOME) to be a symlink. If an attacker can influence OPENCLAW_HOME (or the path it points to) in a higher-privileged execution context, they can redirect creation/overwrite of ~/.openclaw/exec-approvals.json to an unintended directory tree.

Key impact:

• saveExecApprovals() writes exec-approvals.json via a temporary file + renameSync, so the file write is real and persistent.
• With a symlinked OPENCLAW_HOME, writes occur under the symlink target (e.g., /etc/.openclaw/exec-approvals.json), bounded only by OS permissions.

Vulnerable logic (root not checked):

let current = resolvedRoot;
for (const segment of segments) {
  current = path.join(current, segment);
  const stat = fs.lstatSync(current);
  if (stat.isSymbolicLink()) {
    throw new Error(`Refusing to traverse symlink in exec approvals path: ${current}`);
  }
}

While rejecting symlinks below the root still helps, accepting a symlinked root removes an important safety property for environments where OPENCLAW_HOME is not fully trusted.

Recommendation

If OPENCLAW_HOME is intended to be a security boundary (“trusted approvals root”), keep allowing symlinked roots only when explicitly opted-in, or harden the file creation to prevent symlink-root redirection.

Options:

1. Reinstate root lstat check (previous behavior) unless you have a strong reason to allow it:

​// Before iterating segments
const rootStat = fs.lstatSync(resolvedRoot);
if (rootStat.isSymbolicLink()) {
  throw new Error(`Refusing symlinked OPENCLAW_HOME approvals root: ${resolvedRoot}`);
}

2. If you must accept symlinked roots, anchor on the realpath and enforce containment against that:

const resolvedRoot = fs.realpathSync(path.resolve(trustedRoot));
const resolvedTarget = path.resolve(targetPath);
​// ensure resolvedTarget is within resolvedRoot, then lstat each component

3. For the final write, prefer an approach that is robust against symlink surprises (platform permitting), e.g. open the directory with O_NOFOLLOW (not directly exposed in Node for all cases) or validate fs.realpathSync(dir) starts with the expected real root.

Also document clearly that OPENCLAW_HOME must be treated as trusted input and should not be attacker-controlled in privileged contexts.

Description

The exec approvals writer attempts to prevent symlink traversal by lstatSync-checking each path component before creating/writing the approvals file. However, the code then performs filesystem operations by pathname (mkdirSync, writeFileSync, renameSync) without using race-resistant primitives (e.g., openat/O_NOFOLLOW-style semantics per path component).

With the change, assertNoSymlinkPathComponents no longer checks the trusted root itself (allowing a symlinked OPENCLAW_HOME). This increases reliance on the subsequent non-atomic path usage.

Impact:

• A local attacker who can modify the filesystem under OPENCLAW_HOME (or swap the symlink target of OPENCLAW_HOME when it is a symlink) could replace a previously-checked directory component with a symlink between the check and the use.
• The subsequent writeFileSync(tempPath, ...) and renameSync(tempPath, filePath) can then be redirected to write attacker-chosen locations, potentially overwriting sensitive files if the process has higher privileges.

Vulnerable sequence:

assertNoSymlinkPathComponents(dir, resolveRequiredHomeDir());
fs.mkdirSync(dir, { recursive: true });
...
fs.writeFileSync(tempPath, raw, { mode: 0o600, flag: "wx" });
fs.renameSync(tempPath, filePath);

Recommendation

Avoid TOCTOU symlink races by performing operations relative to a trusted directory handle and refusing symlinks at use time.

In Node.js, consider:

• Resolving the real home directory with fs.realpathSync.native() and using that as the trusted root (if you must allow symlinked OPENCLAW_HOME, resolve once and then operate under the real path).
• Creating/opening the approvals directory first, then validating it via realpath/lstat, and writing the file via a file descriptor when possible.
• On platforms that support it, use fs.openSync with flags to reduce symlink following, and avoid mkdirSync({recursive:true}) on untrusted paths.

Example hardening (partial):

const rootReal = fs.realpathSync.native(resolveRequiredHomeDir());
const approvalsDir = path.join(rootReal, ".openclaw");
fs.mkdirSync(approvalsDir, { mode: 0o700 });
const st = fs.lstatSync(approvalsDir);
if (!st.isDirectory() || st.isSymbolicLink()) throw new Error("unsafe");

const tmpFd = fs.openSync(path.join(approvalsDir, `...tmp`), "wx", 0o600);
try {
  fs.writeFileSync(tmpFd, raw);
} finally {
  fs.closeSync(tmpFd);
}

If the threat model includes execution with elevated privileges, additionally ignore/clear OPENCLAW_HOME when running as root/admin or when environment is not trusted.