NVIDIA OpenShell を使った AI Agent 環境のガードレイル策

curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | sh

Selected Docker supervisor networking ... network_mode=Host endpoint=https://127.0.0.1:17670

# $(brew --prefix)/var/openshell/gateway.toml
[openshell.drivers.docker]
supervisor_network_mode = "bridge"

brew services restart openshell

# OpenShell's default sandbox image ships without curl or python3.
FROM nvcr.io/nvidia/base/ubuntu:24.04@sha256:d9461f428eea54e553add3a5158a0f245c6e1ea73efc59fff8e98e3d4a38e378

RUN apt-get update \
    && apt-get install -y --no-install-recommends ca-certificates curl python3 \
    && rm -rf /var/lib/apt/lists/*

sbx() { openshell sandbox exec -n "$SANDBOX" --no-tty --timeout 30 -- sh -c "$*" 2>&1; }

create_sandbox() {
  local name=$1; shift
  openshell sandbox create --name "$name" --from "$IMAGE" --no-auto-providers --no-tty --detach "$@" -- sleep infinity
  for _ in $(seq 1 30); do
    openshell sandbox exec -n "$name" --no-tty -- true >/dev/null 2>&1 && return 0
    sleep 2
  done
  echo "sandbox $name did not become ready" >&2
  return 1
}

openshell sandbox create --name policy-check --from openshell-playground:local --no-auto-providers --no-tty --detach -- sleep infinity
openshell sandbox get policy-check --policy-only

version: 1
filesystem_policy:
  include_workdir: true
  read_only:
    - /bin
    - /usr
    - /lib
    - /proc
    - /dev/urandom
    - /etc
    - /var/log
  read_write:
    - /tmp
    - /dev/null
landlock:
  compatibility: best_effort

▸ curl https://api.github.com/zen (expect: denied)
curl: (7) Failed to connect to api.github.com port 443 after 1 ms: Couldn't connect to server
▸ DNS lookup (expect: denied)
198.18.0.3      example.com

NET:REFUSE [MED] DENIED api.github.com [reason:policy_dns_ineligible]
NET:OPEN [MED] DENIED /usr/bin/curl(0) -> api.github.com:443 [reason:transparent_tcp_policy_denied]

version: 1

# Same filesystem baseline as OpenShell's default policy.
filesystem_policy:
  include_workdir: true
  read_only: [/bin, /usr, /lib, /proc, /dev/urandom, /etc, /var/log]
  read_write: [/sandbox, /tmp, /dev/null]
landlock:
  compatibility: best_effort

network_policies:
  github_api:
    name: github-api-readonly
    endpoints:
      - host: api.github.com
        port: 443
        protocol: rest      # terminate TLS and inspect each HTTP request
        enforcement: enforce
        access: read-only   # GET, HEAD, OPTIONS only
    binaries:
      - { path: /usr/bin/curl }

▸ GET https://api.github.com/zen (expect: allowed)
Half measures are as bad as nothing at all.
▸ POST https://api.github.com/user/repos (expect: 403 policy_denied)
{"error":"policy_denied","policy":"github_api","rule":"POST /user/repos","detail":"POST /user/repos not permitted by policy","layer":"l7",...}

openshell policy update "$SANDBOX" \
  --rule-name npm \
  --binary /usr/bin/curl \
  --add-endpoint registry.npmjs.org:443:read-only:rest:enforce \
  --wait

✓ Policy version 2 submitted (hash: 146a3829ebec)
✓ Policy version 2 loaded (active version: 2)
▸ GET https://registry.npmjs.org/ (expect: 200)
200

id: echo
display_name: Echo
category: other
credentials:
  - name: token
    env_vars: [ECHO_TOKEN]
    required: true
    auth_style: bearer
    header_name: authorization
endpoints:
  - host: httpbin.org
    port: 443
    path: /anything/**
    protocol: rest
    access: read-only
    enforcement: enforce
binaries: [/usr/bin/curl]

version: 1

filesystem_policy:
  include_workdir: true
  read_only: [/bin, /usr, /lib, /proc, /dev/urandom, /etc, /var/log]
  read_write: [/sandbox, /tmp, /dev/null]
landlock:
  compatibility: best_effort

# Network policy allows curl to reach postman-echo.com, but the echo provider's
# credential is bound to httpbin.org only. A placeholder sent here must be rejected.
network_policies:
  postman_echo:
    endpoints:
      - host: postman-echo.com
        port: 443
        protocol: rest
        enforcement: enforce
        access: read-only
    binaries:
      - { path: /usr/bin/curl }

openshell profile import -f profiles/echo.yaml
openshell provider create --name echo --type echo --credential ECHO_TOKEN=dummy-not-a-real-secret

▸ what the agent sees in its environment
ECHO_TOKEN=openshell:resolve:env:v460554092086405377_ECHO_TOKEN
▸ send the placeholder to httpbin.org (bound endpoint: proxy resolves it)
    "Authorization": "Bearer dummy-not-a-real-secret",
▸ send the placeholder to postman-echo.com (allowed by policy, not bound: expect 403)
{"error":"credential_endpoint_mismatch","message":"Credential is not authorized for this request endpoint"}

HTTP:GET [INFO] ALLOWED GET https://postman-echo.com/get [policy:postman_echo engine:l7]
HTTP:GET [HIGH] DENIED GET  [policy:postman_echo engine:credential-binding] [reason:credential_endpoint_mismatch]

version: 1

# Same filesystem baseline as OpenShell's default policy.
filesystem_policy:
  include_workdir: true
  read_only: [/bin, /usr, /lib, /proc, /dev/urandom, /etc, /var/log]
  read_write: [/sandbox, /tmp, /dev/null]
landlock:
  compatibility: best_effort

network_policies:
  github_api:
    name: github-api-readonly
    endpoints:
      - host: api.github.com
        port: 443
        protocol: rest      # terminate TLS and inspect each HTTP request
        enforcement: enforce
        access: read-only   # GET, HEAD, OPTIONS only
    binaries:
      - { path: /usr/bin/curl }

HTTP:POST [MED] DENIED POST https://api.github.com/gists [policy:github_api engine:l7] [reason:L7_REQUEST deny POST api.github.com:443/gists ...]
NET:OPEN [MED] DENIED /usr/bin/python3.12(0) -> api.github.com:443 [reason:transparent_tcp_policy_denied]

▸ 6b. write to /var/tmp: world-writable (1777) but not in read_write (expect: Landlock denies)
drwxrwxrwt 2 root root 4096 Sep 30 14:26 /var/tmp
sh: 1: cannot create /var/tmp/zz-persist: Permission denied
▸ 6c. read /var/lib/dpkg/status: world-readable but not in read_only (expect: Landlock denies)
-rw-r--r-- 1 root root 116307 Nov  3 04:34 /var/lib/dpkg/status
head: cannot open '/var/lib/dpkg/status' for reading: Permission denied

# The most access any agent policy in this repo may grant.
version: 1

filesystem_policy:
  read_only: [/bin, /usr, /lib, /proc, /dev/urandom, /etc, /var/log]
  read_write: [/sandbox, /tmp, /dev/null]
landlock:
  compatibility: best_effort

network_policies:
  github_api:
    endpoints:
      - host: api.github.com
        port: 443
        protocol: rest
        enforcement: enforce
        access: read-only
    binaries:
      - { path: /usr/bin/curl }

# Narrower than the boundary: no /var/log read, same GitHub read-only rule.
version: 1

filesystem_policy:
  read_only: [/bin, /usr, /lib, /proc, /dev/urandom, /etc]
  read_write: [/sandbox, /tmp, /dev/null]
landlock:
  compatibility: best_effort

network_policies:
  github_api:
    endpoints:
      - host: api.github.com
        port: 443
        protocol: rest
        enforcement: enforce
        access: read-only
    binaries:
      - { path: /usr/bin/curl }

# Looks like a small change, but grants writes to GitHub and cloud metadata access.
version: 1

filesystem_policy:
  read_only: [/bin, /usr, /lib, /proc, /dev/urandom, /etc, /var/log]
  read_write: [/sandbox, /tmp, /dev/null]
landlock:
  compatibility: best_effort

network_policies:
  github_api:
    endpoints:
      - host: api.github.com
        port: 443
        protocol: rest
        enforcement: enforce
        access: read-write
    binaries:
      - { path: /usr/bin/curl }
  metadata:
    endpoints:
      - host: 169.254.169.254
        port: 80
    binaries:
      - { path: /usr/bin/curl }

# Same as the boundary plus one rule for the cloud metadata endpoint.
# Result is within_boundary: OpenShell never authorizes link-local destinations,
# so this rule grants nothing (docs: policies/network-rules "Restrict Destination Addresses").
version: 1

filesystem_policy:
  read_only: [/bin, /usr, /lib, /proc, /dev/urandom, /etc, /var/log]
  read_write: [/sandbox, /tmp, /dev/null]
landlock:
  compatibility: best_effort

network_policies:
  github_api:
    endpoints:
      - host: api.github.com
        port: 443
        protocol: rest
        enforcement: enforce
        access: read-only
    binaries:
      - { path: /usr/bin/curl }
  metadata:
    endpoints:
      - host: 169.254.169.254
        port: 80
    binaries:
      - { path: /usr/bin/curl }

▸ candidates/metadata.yaml
result: within_boundary
▸ candidates/ok.yaml
result: within_boundary
▸ candidates/too-wide.yaml
result: exceeds_boundary
counterexample: network ... host=api.github.com:443 ... protocol=rest method=POST path=/

      - name: install openshell-prover
        run: |
          curl -sSfLO "https://github.com/NVIDIA/OpenShell/releases/download/${PROVER_VERSION}/${PROVER_ASSET}"
          echo "${PROVER_SHA256}  ${PROVER_ASSET}" | sha256sum -c -
          tar xzf "${PROVER_ASSET}" -C "${RUNNER_TEMP}" openshell-prover
          echo "${RUNNER_TEMP}" >> "${GITHUB_PATH}"

      - name: boundary check
        working-directory: policies
        run: openshell-prover check candidates/ok.yaml --boundary boundary.yaml