MausBot turns agent CLIs into a familiar desktop chat app. Each bot can have its own model, instructions, working folder, connected apps, computer, and recurring work.
You can build a team of AI agents that can talk, use tools, operate computers, and keep working on a schedule.
MausBot is an open-source Grok Bot alternative with a virtual machine that bots can use.
I found a file named omb-home-narrow.apparmor in the MausBot codebase. I never came across such a file type ‘.apparmor’, so I googled what it means and found this apparmor.net/
AppArmor is an effective and easy-to-use Linux application security system. AppArmor proactively protects the operating system and applications from external or internal threats, even zero-day attacks, by enforcing good behavior and preventing both known and unknown application flaws from being exploited.
well, I also wondered if omb-home-narrow file name had any special meaning, but it did not. Below is a comment I picked from that file:
# omb-home-narrow: omb-home, plus a refusal of every filesystem type a user # namespace may mount that bubblewrap# never does (it mounts only tmpfs, proc and devpts, and binds). Overlay and # FUSE in user namespaces are where most# unprivileged-namespace kernel bugs have been; a bot cannot reach them # through this container.
and this file also deny commands, preventing access to senstive files on your machine.
deny mount fstype=overlay, deny mount fstype=fuse, deny mount fstype=fuseblk, deny mount fstype=sysfs, deny mount fstype=mqueue, deny mount fstype=cgroup, deny mount fstype=cgroup2, deny mount fstype=ramfs, deny mount fstype=binfmt_misc, deny mount fstype=bpf,
I found this snippet that could help us understand more about this file
AppArmor profiles are the fundamental building blocks of system security. They act as a set of rules that dictate exactly what a confined application is allowed to do.
I spent 3+ years studying OSS codebases and wrote 400+ articles on what makes the production-grade. Now I'm putting that into practice differently - instead of writing every fix myself, I run coding agents that do it.
How it works? Register your machine as a Runtime, point it at your repo. Agents pick up issues. write the fix, open the PR. You just review, they execute.
