I built OpenShell's Z3 policy prover and ran 29 checks. It caught everything except the metadata address.

说明与用途

OpenShell 的策略证明器能检测大多数违规，但由于 IP 范围被排除，未能捕获元数据地址的访问。

问题

Verify that a candidate policy stays within a boundary policy using OpenShell’s SMT‑based prover, and identify gaps in its coverage.

结果

The prover caught all but metadata‑address reachability; the gap is due to excluded IP ranges in the containment model.

工作流

• Clone the OpenShell repo (commit 9a85667).
• Build the prover with Rust, linking against the Python z3‑solver wheel (libz3.so 5.3.1).
• Run the CLI on 29 candidate/boundary policy pairs.
• Collect verdicts and counterexamples.
• Analyze the prover’s IP containment model for exclusions.
• Compare results with the runtime’s hard‑blocked IP list.
• Document the discrepancy between the prover’s coverage and the actual enforcement.

证据

The prover ships as a standalone CLI, openshell-prover, whose job is a boundary check: given a candidate policy and a boundary policy (the most access an environment allows), decide whether the candidate stays inside the boundary — and if not, produce a counterexample.

来源

Three things deserve credit before the failure. First, the counterexamples are concrete: ... Second, you cannot lauran a read-only REST rule through a raw L4 endpoint to the same host — it models the difference. Third, when a comparison depends on facts it doesn't have — is /etc/passwd contained by /etc given symlinks in an image it can't see? — it returns unsupported and exits 3 rather than guessing.

来源

A policy whose only network rule is "curl may reach 169.254.169.254" — the cloud metadata address, the SSRF greatest hit, the thing the Hugging Face agent incident ran on — passes the boundary check.

来源

Loopback, link-local, and unspecified addresses are excluded from the destination-IP containment model.

来源

The runtime hard‑blocks the same ranges regardless of policy — is_always_blocked_ip in the supervisor's network code, with a test literally named test_declared_endpoint_loopback_stays_blocked.

来源