Issue Station
Sign In
Tools hereToolbox

openclaw - ✅(Solved) Fix macOS: gateway LaunchAgent plist is written with 0644 instead of 0600 [1 pull requests, 1 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#57967•Fetched 2026-04-08 01:55:32
View on GitHub
Comments
0
Participants
1
Timeline
1
Reactions
0
Author
l0hdel0hde
Participants
l0hdel0hde
Timeline (top)
cross-referenced ×1

On macOS, the gateway LaunchAgent plist appears to be written with mode 0644 instead of 0600.

In our setup this showed up as a recurring permission hardening issue for:

~/Library/LaunchAgents/ai.openclaw.gateway.plist

Root Cause

This is minor but worth fixing because:

  • OpenClaw already hardens other sensitive local files to 0600
  • the LaunchAgent plist can contain service metadata / env-related config
  • repeated local repair/hardening workflows may keep needing to re-tighten it

If helpful, I can also open a tiny PR for the constant change.

Fix Action

Fixed

PR fix notes

PR #57971: fix(macOS): write gateway LaunchAgent plist with 0600

Description (problem / solution / changelog)

Summary

Write the macOS gateway LaunchAgent plist with 0600 instead of 0644.

This matches the expected owner-only permissions for the plist created under:

  • ~/Library/LaunchAgents/ai.openclaw.gateway.plist

Closes #57967.

Changes

  • change LAUNCH_AGENT_PLIST_MODE from 0o644 to 0o600

Why

The current mode leaves the plist group/world-readable. For a user-specific LaunchAgent written by OpenClaw, 0600 is the safer default and aligns better with other local file hardening in the project.

Testing

Manual:

  1. openclaw gateway start
  2. stat -f "%Lp %N" ~/Library/LaunchAgents/ai.openclaw.gateway.plist
  3. verify mode is 600

Changed files

  • src/daemon/launchd.ts (modified, +1/-1)
RAW_BUFFERClick to expand / collapse

Summary

On macOS, the gateway LaunchAgent plist appears to be written with mode 0644 instead of 0600.

In our setup this showed up as a recurring permission hardening issue for:

~/Library/LaunchAgents/ai.openclaw.gateway.plist

Expected

The LaunchAgent plist should be owner-readable/writable only:

  • expected mode: 0600

Actual

The plist is written with:

  • actual mode: 0644

Repro

  1. Run:
    • openclaw gateway start
  2. Check the plist permissions:
    • stat -f "%Lp %N" ~/Library/LaunchAgents/ai.openclaw.gateway.plist
  3. Observe mode 644

Likely source

In the installed OpenClaw build, the launchd writer sets:

  • file: dist/launchd-BdxtrFXa.js
  • constant: LAUNCH_AGENT_PLIST_MODE = 420

420 decimal corresponds to 0644.

The plist is then written/chmod'd using that constant.

Suggested fix

Change the LaunchAgent plist mode from decimal 420 (0644) to decimal 384 (0600).

Why this matters

This is minor but worth fixing because:

  • OpenClaw already hardens other sensitive local files to 0600
  • the LaunchAgent plist can contain service metadata / env-related config
  • repeated local repair/hardening workflows may keep needing to re-tighten it

If helpful, I can also open a tiny PR for the constant change.

extent analysis

Fix Plan

To fix the issue, we need to update the LAUNCH_AGENT_PLIST_MODE constant in the launchd-BdxtrFXa.js file.

  • Open the file dist/launchd-BdxtrFXa.js in a text editor.
  • Locate the line where LAUNCH_AGENT_PLIST_MODE is defined and update its value to 384 (decimal equivalent of 0600).
  • Save the changes.

Example code snippet:

// Before
const LAUNCH_AGENT_PLIST_MODE = 420; // 0644

// After
const LAUNCH_AGENT_PLIST_MODE = 384; // 0600
  • Rebuild and redeploy the OpenClaw gateway to apply the changes.

Verification

To verify the fix, follow these steps:

  • Run openclaw gateway start.
  • Check the plist permissions using stat -f "%Lp %N" ~/Library/LaunchAgents/ai.openclaw.gateway.plist.
  • The output should show the mode as 600.

Extra Tips

  • Consider opening a PR for the constant change to ensure the fix is persisted in the codebase.
  • Review other sensitive files in the OpenClaw setup to ensure they are properly hardened to 0600.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#model loading#dependency error#configuration error#environment variable#network issue

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING