I built OpenShell's Z3 policy prover and ran 29 checks. It caught everything except the metadata address.

Описание и применение

Проверка политики OpenShell с помощью SMT‑прокторов выявила, что большинство нарушений обнаруживаются, но адрес метаданных пропускается из‑за исключения диапазонов IP в модели.

Задача

Verify that a candidate policy stays within a boundary policy using OpenShell’s SMT‑based prover, and identify gaps in its coverage.

Результат

The prover caught all but metadata‑address reachability; the gap is due to excluded IP ranges in the containment model.

Рабочий процесс

• Clone the OpenShell repo (commit 9a85667).
• Build the prover with Rust, linking against the Python z3‑solver wheel (libz3.so 5.3.1).
• Run the CLI on 29 candidate/boundary policy pairs.
• Collect verdicts and counterexamples.
• Analyze the prover’s IP containment model for exclusions.
• Compare results with the runtime’s hard‑blocked IP list.
• Document the discrepancy between the prover’s coverage and the actual enforcement.

Доказательства

The prover ships as a standalone CLI, openshell-prover, whose job is a boundary check: given a candidate policy and a boundary policy (the most access an environment allows), decide whether the candidate stays inside the boundary — and if not, produce a counterexample.

Источник

Three things deserve credit before the failure. First, the counterexamples are concrete: ... Second, you cannot lauran a read-only REST rule through a raw L4 endpoint to the same host — it models the difference. Third, when a comparison depends on facts it doesn't have — is /etc/passwd contained by /etc given symlinks in an image it can't see? — it returns unsupported and exits 3 rather than guessing.

Источник

A policy whose only network rule is "curl may reach 169.254.169.254" — the cloud metadata address, the SSRF greatest hit, the thing the Hugging Face agent incident ran on — passes the boundary check.

Источник

Loopback, link-local, and unspecified addresses are excluded from the destination-IP containment model.

Источник

The runtime hard‑blocks the same ranges regardless of policy — is_always_blocked_ip in the supervisor's network code, with a test literally named test_declared_endpoint_loopback_stays_blocked.

Источник