Security review

[lionello]

Critical issues:

1. Default full autonomy
   skipPermissions = true means --dangerously-skip-permissions by default. That is the biggest red flag. Any agent compromise becomes arbitrary command execution as that Unix user.
2. Remote control enabled by default
   remoteControl = true exposes the session to Claude apps by default. That expands the control plane. Should be opt-in, not default.
3. Normal users, persistent homes
   It creates real isNormalUser accounts with writable /home/<name>. Good for isolation from root, bad for persistence and lateral movement if secrets, SSH keys, git creds, or dotfiles accumulate.
4. Passwordless sudo with SETENV
   The sudo allowlist supports NOPASSWD and SETENV. SETENV is risky because env vars can alter behavior of many binaries/scripts. I’d remove it unless absolutely needed.
5. Secrets via EnvironmentFile
   Better than Nix store, but services get tokens as env vars. Child processes can inherit them; tools may leak them to logs, crash dumps, process inspection by same user, shell history, etc.
6. Token dir is 0755
   /etc/claude-box is world-readable/traversable by default. Files may be 600, but the module does not enforce file ownership/mode for ${name}.env. Easy footgun.
7. No systemd hardening
   Missing NoNewPrivileges, PrivateTmp, ProtectSystem, ProtectHome, RestrictSUIDSGID, SystemCallFilter, CapabilityBoundingSet, etc. For an AI agent runner, that’s weak.
8. Command construction smells
   claudeCmd is built via string concatenation, then wrapped into shell/tmux. Some args are escaped later as a whole command string, but extraArgs and remoteControlName are not individually shell-escaped before joining. The docs say “keep it shell-safe,” which is not enforcement.

Verdict: usable only as a trusted-dev-box toy, not production-safe. I’d change defaults to:

skipPermissions = false;
remoteControl = false;

Also remove SETENV, make token dir 0710 or 0700, enforce token file modes, shell-escape every arg individually, add systemd sandboxing, and consider ephemeral users/homes.

[defangdevs]

Plan — triage of the 8 findings

Taking as one PR (objective fixes)

• Finding 4 — Remove SETENV from the sudo options. NOPASSWD is enough for typical allowlist commands (systemctl reload caddy, etc.). SETENV lets the agent alter env vars visible to those sudo'd commands, which broadens the effective surface with no upside for the intended use.
• Finding 6 — Tighten tokenDir to 0700 root:root. systemd reads EnvironmentFile= as root, so the agent user never needs to traverse this directory. 0755 today just leaks filenames (which reveal usernames). Add a matching tmpfiles Z rule to enforce mode 0600 on any *.env file already present.
• Finding 8 — Individually shell-escape sessionName and extraArgs when building claudeCmd via lib.escapeShellArg per element. Current concatStringsSep " " join is a real bug if a remoteControlName or extraArgs element contains whitespace or shell metacharacters. Also add an assertion on remoteControlName (non-empty, no NUL, no CR/LF).
• Finding 7 — systemd hardening. Add a conservative baseline to each agent's serviceConfig: NoNewPrivileges, PrivateTmp, ProtectSystem = "strict" + ReadWritePaths = [ "/home/${name}" ], ProtectKernelTunables/Modules/ControlGroups, RestrictSUIDSGID, RestrictNamespaces (with the small carve-out tmux needs — will validate), LockPersonality, RestrictRealtime, PrivateDevices=true (pty subsystem stays available). Skipping MemoryDenyWriteExecute (breaks Node's JIT) and SystemCallFilter=@system-service initially — the latter tends to break bun/node/git in surprising ways; can layer in later after testing.

Pushing back (defaults are intentional, will document more loudly)

• Finding 1 — skipPermissions=true default. This is the reason claude-box exists — a headless, autonomous agent runner. Flipping the default to false makes the module useless for its stated purpose (every action would block on an interactive approval prompt with no interactive user around to answer). Keeping the default; adding a stronger warning in the option description AND in the README security section that this is autonomy inside claude-code and NOT an OS-level sandbox — the OS sandbox is the unprivileged user plus the systemd hardening from finding 7 plus the tight sudoAllowlist.
• Finding 2 — remoteControl=true default. Same shape: this default is what makes the "drive from the Claude apps" UX work with zero extra config, which is the module's headline feature. Keeping the default; documenting more clearly and pointing at how to disable per-user (users.<name>.remoteControl = false).
• Finding 3 — Persistent homes. Ephemeral homes would defeat "long-running agent." The isolation-from-root is what the systemd hardening in finding 7 tightens.

Note (fundamental tradeoff, not fixable at this layer)

• Finding 5 — Secrets via EnvironmentFile. Any secret in an env var can be inherited by child processes, land in coredumps, be read by /proc/<pid>/environ, etc. That's inherent to env-var secrets, not a claude-box bug. A future improvement could migrate to systemd credentials (LoadCredential=) that expose secrets as files under $CREDENTIALS_DIRECTORY — but only worth doing if claude-code (or the tools running under it) actually read from there. Filing a separate follow-up rather than blocking on it here.

Order of work

One PR containing findings 4, 6, 7, 8 module changes + the README security-section rewrite for findings 1/2/3. Follow-up issue for finding 5.