48-OpenClaw安全加固:权限与审计

引言

OpenClaw 拥有强大的工具和 API 访问能力，但这也意味着安全风险——如果被恶意利用，后果不堪设想。

今天我们来系统学习 OpenClaw 的安全加固方案：权限控制、审计日志、敏感操作保护。

正文

权限模型概述

OpenClaw 采用 RBAC（基于角色的访问控制） 模型：

用户 (User)
    ↓ 关联角色
角色 (Role)
    ↓ 关联权限
权限 (Permission)
    ↓ 允许操作
工具 (Tool) + 资源 (Resource)

# openclaw.yml
security:
  rbac:
    enabled: true

    roles:
      - name: admin
        permissions:
          - "*"  # 全部权限

      - name: developer
        permissions:
          - "exec:run"
          - "file:read"
          - "file:write"
          - "browser:*"
          - "web_*"

      - name: viewer
        permissions:
          - "file:read"
          - "web_fetch"

      - name: restricted
        permissions:
          - "web_fetch"

    assignments:
      - user: "zhangsan@company.com"
        roles: ["developer"]
      - user: "lisi@company.com"
        roles: ["viewer"]
      - user: "intern@company.com"
        roles: ["restricted"]

工具级别的权限控制

tools:
  exec:
    permission: "exec:run"
    allowed_commands:    # 白名单模式
      - "git *"
      - "npm *"
      - "ls *"
      - "cat *"
    denied_commands:     # 黑名单模式
      - "rm -rf /*"
      - "ssh *"
      - "curl *"

  file:
    permission: "file:write"
    allowed_paths:       # 限制可写目录
      - "/workspace/projects/*"
      - "/tmp/openclaw/*"
    denied_paths:        # 禁止访问目录
      - "/etc/*"
      - "/root/*"
      - "~/.ssh/*"
      - "~/.aws/*"

  feishu_doc:
    permission: "feishu_doc:write"
    allowed_docs:        # 限制可操作的文档
      - "docx-*workspace*"  # 只允许工作区文档
    denied_docs:
      - "docx-*confidential*"  # 禁止机密文档

敏感操作二次确认

security:
  confirmation:
    enabled: true

    # 高危命令黑名单
    dangerous_patterns:
      - pattern: "rm -rf"
        message: "即将删除文件，确认执行？"
        require_typing: "DELETE"  # 需要输入特定文字确认

      - pattern: "drop table"
        message: "即将删除数据库表，确认执行？"
        require_approval: true

      - pattern: "exec.*sudo"
        message: "即将执行特权命令，确认？"
        require_approval: true
        notify_channels: ["security-alerts"]

    # 文件操作大小限制
    file_operations:
      max_file_size: "10MB"           # 单文件大小限制
      max_total_size: "100MB"         # 批量操作总大小限制
      scan_on_write: true              # 写入前扫描恶意代码

审计日志

security:
  audit:
    enabled: true
    log_level: "detailed"  # minimal | standard | detailed

    # 日志存储
    storage:
      type: "elasticsearch"  # 或 loki, splunk, file
      host: "elk.company.com"
      index: "openclaw-audit"
      retention: 90d        # 保留90天

    # 记录的事件类型
    events:
      - tool_execution       # 工具执行
      - file_access          # 文件访问
      - message_sent         # 消息发送
      - login_logout          # 登录登出
      - permission_change     # 权限变更
      - config_change         # 配置变更
      - subagent_spawn        # 子代理创建

    # 告警规则
    alerts:
      - name: "异常批量下载"
        condition: "file_read.count > 100 AND duration < 60s"
        severity: "high"
        action: "notify_security_team"

      - name: "未授权访问"
        condition: "tool_execution.permission_denied == true"
        severity: "critical"
        action: "block_and_notify"

// 审计日志格式示例
const auditLog = {
  timestamp: "2026-04-08T10:30:45.123Z",
  event_type: "tool_execution",

  actor: {
    user_id: "user_123",
    email: "zhangsan@company.com",
    roles: ["developer"],
    ip: "192.168.1.100"
  },

  target: {
    tool: "exec",
    command: "curl https://api.example.com/data",
    resource: null
  },

  result: {
    status: "success",
    duration_ms: 1250,
    output_size: 1024
  },

  context: {
    session_id: "sess_abc123",
    channel: "feishu",
    agent_id: "agent_main"
  },

  metadata: {
    flags: ["allowed_by_policy"],
    warnings: []
  }
}

安全最佳实践

1. 最小权限原则

# 给新用户默认最小权限
security:
  default_role: "restricted"  # 新用户默认只有受限权限
  new_user_approval: true    # 新用户需要管理员审批

2. API Key 安全

security:
  api_keys:
    encryption: "AES-256-GCM"
    rotation_days: 90
    max_per_user: 3
    require_description: true

    # 只读密钥（限制部分权限）
    read_only_keys:
      enabled: true
      allowed_tools: ["web_fetch", "file:read"]

3. 网络隔离

security:
  network:
    allowed_outbound:        # 允许访问的域名
      - "*.company.com"
      - "api.openai.com"
      - "api.feishu.cn"

    blocked_outbound:        # 禁止访问的域名
      - "*pastebin*"
      - "*tunnel*"
      - "*.onion"

    proxy:                   # 出站流量代理
      enabled: true
      endpoint: "http://proxy.company.com:8080"

4. 安全审计查询

// 查询用户的所有操作
const userActivity = await searchAuditLogs({
  filter: {
    'actor.user_id': 'user_123',
    timestamp: { $gte: '2026-04-01', $lte: '2026-04-08' }
  },
  sort: { timestamp: -1 }
})

// 查询高危操作
const dangerousOps = await searchAuditLogs({
  filter: {
    event_type: 'tool_execution',
    'target.tool': { $in: ['exec', 'file'] },
    'result.status': 'success'
  },
  lookback: '24h'
})

// 异常行为检测
const anomalies = await detectAnomalies({
  baseline_user: 'user_123',
  current_window: '1h',
  thresholds: {
    file_operations: { max: 50 },
    exec_calls: { max: 20 }
  }
})

总结

OpenClaw 安全加固的核心：

1. RBAC 权限模型：用户 → 角色 → 权限 → 工具

2. 白名单优先：允许名单之外的一切操作

3. 敏感操作二次确认：高危命令需要额外验证

4. 完整审计日志：记录一切，便于追溯