fix(policy): allow read-only dpkg package inspection

agents/hermes/policy-additions.yaml

@@ -23,6 +23,7 @@ filesystem_policy:
     - /app
     - /etc
     - /var/log
+    - /var/lib/dpkg                  # Allow package-version inspection without package mutation.
   read_write:
     - /sandbox
     - /tmp

agents/hermes/policy-permissive.yaml

@@ -24,6 +24,7 @@ filesystem_policy:
     - /app
     - /etc
     - /var/log
+    - /var/lib/dpkg                  # Allow package-version inspection without package mutation.
   read_write:
     - /sandbox
     - /tmp

agents/langchain-deepagents-code/policy-additions.yaml

@@ -20,6 +20,7 @@ filesystem_policy:
     - /app
     - /etc
     - /var/log
+    - /var/lib/dpkg                  # Allow package-version inspection without package mutation.
   read_write:
     - /sandbox
     - /sandbox/.deepagents

agents/openclaw/policy-permissive.yaml

@@ -20,6 +20,7 @@ filesystem_policy:
     - /app
     - /etc
     - /var/log
+    - /var/lib/dpkg                  # Allow package-version inspection without package mutation.
   read_write:
     - /tmp
     - /dev/null

docs/reference/network-policies.mdx

@@ -37,12 +37,15 @@ Deep Agents uses strict Landlock compatibility, so sandbox startup fails when Op
 | Path | Access |
 |---|---|
 | `/sandbox`, `/tmp`, `/dev/null`, `/dev/pts` | Read-write |
-| `/usr`, `/lib`, `/proc`, `/dev/urandom`, `/app`, `/etc`, `/var/log` | Read-only |
+| `/usr`, `/lib`, `/proc`, `/dev/urandom`, `/app`, `/etc`, `/var/log`, `/var/lib/dpkg` | Read-only |
 
 `/dev/pts` is the pseudo-terminal (devpts) directory.
 It is writable so PTY-based tools (`tmux`, `script`, and interactive shells) can allocate a terminal.
 Without it, those tools fail with `fork failed: Permission denied`.
 
+Read-only access to `/var/lib/dpkg` lets `dpkg-query` inspect installed package metadata.
+The filesystem policy does not grant write access to the package database.
+
 The sandbox process runs as a dedicated `sandbox` user and group.
 <AgentOnly variant="openclaw">
 Landlock LSM enforcement applies on a best-effort basis.

docs/security/best-practices.mdx

@@ -285,7 +285,7 @@ The container mounts system directories read-only to prevent the agent from modi
 
 | Aspect | Detail |
 |---|---|
-| Default | `/usr`, `/lib`, `/proc`, `/dev/urandom`, `/app`, `/etc`, `/var/log` are read-only. |
+| Default | `/usr`, `/lib`, `/proc`, `/dev/urandom`, `/app`, `/etc`, `/var/log`, and `/var/lib/dpkg` are read-only. |
 | What you can change | Add or remove paths in the `filesystem_policy.read_only` section of the policy file. |
 | Risk if relaxed | Making `/usr` or `/lib` writable lets the agent replace system binaries (such as `curl` or `node`) with trojanized versions. Making `/etc` writable lets the agent modify DNS resolution, TLS trust stores, or user accounts. |
 | Recommendation | Never make system paths writable. If the agent needs a writable location for generated files, use a subdirectory of `/sandbox`. |

nemoclaw-blueprint/policies/openclaw-sandbox-permissive.yaml

@@ -25,6 +25,7 @@ filesystem_policy:
     - /app
     - /etc
     - /var/log
+    - /var/lib/dpkg                  # Allow package-version inspection without package mutation.
   read_write:
     - /tmp
     - /dev/null

nemoclaw-blueprint/policies/openclaw-sandbox.yaml

@@ -28,6 +28,7 @@ filesystem_policy:
     - /app
     - /etc
     - /var/log
+    - /var/lib/dpkg                  # Allow package-version inspection without package mutation.
   read_write:
     - /tmp
     - /dev/null

src/lib/onboard/initial-policy-real-policy.test.ts

@@ -30,7 +30,7 @@ type PolicyEntry = {
 };
 
 type PolicyDocument = {
-  filesystem_policy?: { read_write?: string[] };
+  filesystem_policy?: { read_only?: string[]; read_write?: string[] };
   network_policies?: Record<string, PolicyEntry>;
 };
 
@@ -140,6 +140,37 @@ describe("initial sandbox policy real preset merge", () => {
     }
   });
 
+  it("grants read-only package database access in every shipping sandbox policy (#8467)", () => {
+    const policyCases = [
+      { path: ["nemoclaw-blueprint", "policies", "openclaw-sandbox.yaml"], agent: "openclaw" },
+      {
+        path: ["nemoclaw-blueprint", "policies", "openclaw-sandbox-permissive.yaml"],
+        agent: "openclaw",
+      },
+      { path: ["agents", "openclaw", "policy-permissive.yaml"], agent: "openclaw" },
+      { path: ["agents", "hermes", "policy-additions.yaml"], agent: "hermes" },
+      { path: ["agents", "hermes", "policy-permissive.yaml"], agent: "hermes" },
+      {
+        path: ["agents", "langchain-deepagents-code", "policy-additions.yaml"],
+        agent: "langchain-deepagents-code",
+      },
+    ];
+
+    for (const policyCase of policyCases) {
+      const prepared = prepareInitialSandboxCreatePolicy(repoPath(...policyCase.path), [], {
+        agentName: policyCase.agent,
+      });
+      const policy = readPreparedPolicy(prepared);
+      const readOnly = policy.filesystem_policy?.read_only ?? [];
+      const readWrite = policy.filesystem_policy?.read_write ?? [];
+
+      expect(readOnly, policyCase.path.join("/")).toContain("/var/lib/dpkg");
+      for (const writableAncestor of ["/", "/var", "/var/lib", "/var/lib/dpkg"]) {
+        expect(readWrite, policyCase.path.join("/")).not.toContain(writableAncestor);
+      }
+    }
+  });
+
   it("preserves baseline writable paths in effective OpenClaw permissive create policies", () => {
     const baseline = readPreparedPolicy(
       prepareInitialSandboxCreatePolicy(