aios/aios
1
0
Fork 0
Code Issues Pull Requests 5 Actions Packages Projects Releases Wiki Activity

feat(openclaw): add hardened candidate native adapter unit

Browse Source
This commit is contained in:
chatgpt-final-release-writer
2026-07-26 01:24:46 +08:00
parent 34d04a412a
commit 89bec6de6c
1 changed files with 45 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/aios-session-broker-candidate/aios-openclaw-native-session-adapter-candidate.service
+45
View File
@@ -0,0 +1,45 @@
[Unit]
Description=AIOS Candidate OpenClaw Native Session Adapter
After=network-online.target
Wants=network-online.target
ConditionPathIsDirectory=/data/aios-gitops/worktrees/chatgpt-session-broker-final-release-20260726
[Service]
Type=simple
User=aiman
Group=gitops
UMask=0077
WorkingDirectory=/data/aios-gitops/worktrees/chatgpt-session-broker-final-release-20260726
RuntimeDirectory=aios-chatgpt-openclaw-native-session
StateDirectory=aios-chatgpt-openclaw-native-session
Environment=AIOS_CANDIDATE_TASK_ID=AIOS-CHATGPT-SESSION-BROKER-FINAL-RELEASE-20260726
Environment=AIOS_CANDIDATE_BRANCH=patch/chatgpt-session-broker-final-release-20260726
Environment=AIOS_CANDIDATE_BASE_OID=875d41c3101093149414292067fd700dc214d4d3
Environment=AIOS_CANDIDATE_CAPABILITIES=session.read,session.send,session.interrupt,session.close
Environment=AIOS_CANDIDATE_ALLOWED_PATHS=tests/session-broker-final-release-channel.txt
Environment=AIOS_OPENCLAW_PROFILE=aios-chatgpt-candidate
Environment=OPENCLAW_STATE_DIR=/run/aios-chatgpt-openclaw-native-session/openclaw-state
Environment=OPENCLAW_CONFIG_PATH=/run/aios-chatgpt-openclaw-native-session/openclaw.json
EnvironmentFile=/run/aios-chatgpt-openclaw-native-session/grant.env
LoadCredential=openclaw_gateway_credential:/etc/aios-gitops/credentials/openclaw-gateway-candidate
ExecStart=/usr/bin/python3 /data/aios-gitops/worktrees/chatgpt-session-broker-final-release-20260726/services/aios-session-broker-candidate/candidate_native_session_adapters.py --provider openclaw --database /var/lib/aios-chatgpt-openclaw-native-session/native-sessions.sqlite3 --host 127.0.0.1 --port 19941
Restart=on-failure
RestartSec=2
NoNewPrivileges=true
PrivateTmp=true
PrivateDevices=true
ProtectSystem=strict
ProtectHome=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
LockPersonality=true
RestrictSUIDSGID=true
RestrictRealtime=true
MemoryDenyWriteExecute=true
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
ReadOnlyPaths=/data/aios-gitops/repo.git
ReadOnlyPaths=/data/aios-gitops/worktrees/chatgpt-session-broker-final-release-20260726
ReadWritePaths=/run/aios-chatgpt-openclaw-native-session
ReadWritePaths=/var/lib/aios-chatgpt-openclaw-native-session