Upgrade supply chain demo to scoped capabilities with active defense by danbugs · Pull Request #76 · hyperlight-dev/hyperlight-unikraft

danbugs · 2026-05-20T22:49:46Z

Summary

Replace custom kernel/rootfs build (Dockerfile + kraft.yaml) with pyhl — no build step needed, just just setup + just run
Guest now has real capabilities (--mount ./workspace, --net-allow example.com) and performs legitimate work: reads input file, fetches from example.com, writes output
Every malicious action is still actively blocked by Hyperlight's policy enforcement — not just absent resources
Add cloud metadata probing phase (AWS/Azure/GCP IMDS at 169.254.169.254) to stealer, blocked by link-local policy
Improve error messages: "Connection denied (loopback policy)", "BLOCKED (link-local policy)"
Update graphic to show scoped capabilities with aligned sections and legitimate work
Update README with pyhl-based instructions and active defense explanation

Test plan

cd demos/supply-chain && ./bare-metal/run.sh — attack succeeds, legitimate work succeeds
cd demos/supply-chain/hl-unikraft && just setup && just run — legitimate work succeeds, attack contained
cd demos/supply-chain/hl-unikraft && just run-minimal — network fetch fails, everything else same as scoped

…fense Replace custom kernel/rootfs build with pyhl for the Hyperlight sandbox. The guest now has real capabilities (--mount for workspace, --net-allow for example.com) and performs legitimate work (read input, fetch HTTP, write output) while every malicious action is still actively blocked by policy enforcement: loopback denied, link-local denied, scoped mount, no env forwarding. Add cloud metadata probing phase (IMDS) to stealer. Update graphic and README to reflect active defense model. Signed-off-by: danbugs <danilochiarlone@gmail.com>

Copilot

Pull request overview

This PR updates the supply-chain demo to run via pyhl (warmed Python snapshot) instead of a custom Unikraft kernel/rootfs build, and expands the “malicious” package behavior to include cloud metadata probing while demonstrating Hyperlight policy enforcement with scoped mount/network capabilities.

Changes:

Replace the hl-unikraft/ demo workflow (Dockerfile + kraft.yaml) with a pyhl-driven Justfile (just setup, just run, just run-minimal).
Extend the simulated stealer to probe IMDS endpoints (AWS/Azure/GCP) and improve “blocked” status messaging.
Update demo materials (README, new graphic, victim app) to include legitimate work (read input, fetch example.com, write output).

Reviewed changes

Copilot reviewed 9 out of 10 changed files in this pull request and generated 9 comments.

Show a summary per file

File	Description
demos/supply-chain/victim_app.py	Adds workspace IO + allowed network fetch to represent legitimate workload.
demos/supply-chain/reqeusts/stealer.py	Adds IMDS probing phase and updates summary output.
demos/supply-chain/README.md	Updates narrative and run instructions for the new `pyhl` workflow.
demos/supply-chain/hl-unikraft/Justfile	Replaces build pipeline with `pyhl setup/run` commands and demo scaffolding.
demos/supply-chain/hl-unikraft/kraft.yaml	Removed (no longer needed with `pyhl`).
demos/supply-chain/hl-unikraft/Dockerfile	Removed (no longer needed with `pyhl`).
demos/supply-chain/graphic.html	Adds an updated graphic illustrating scoped capabilities + active defense.
demos/supply-chain/bare-metal/run.sh	Adds workspace input/output handling for legitimate workload on bare metal.
demos/supply-chain/.gitignore	Ignores generated demo artifacts under `hl-unikraft/`.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

+Install `pyhl` (the Hyperlight Python runtime):
+
+```bash
+cargo install --path tools/pyhl


+# One-time setup — installs kernel + rootfs, warms Python snapshot
+just setup
+
+# Scoped sandbox: mount + network, attack still contained
+just run

-# Run
-just run       # Execute inside the sandbox
+# Minimal sandbox: no mount, no network (total isolation)
+just run-minimal


+for workspace access, `--net-allow example.com` for network). Legitimate work
+succeeds, but every malicious action is blocked by active policy enforcement:
+
+- **Credential theft → BLOCKED** — `~/.ssh/id_rsa`, `~/.aws/credentials`, etc.
+  are outside the mounted workspace. The guest has filesystem access, but only


+# Install pyhl image with hostfs + networking baked into snapshot
+setup: prepare
+    pyhl setup --mount {{guest_dir}} --net
+
+# Scoped sandbox: guest has mount + network, but attack is still contained
+#   - Legitimate work succeeds: reads input.txt, GETs example.com, writes output.txt
+#   - Credential theft: BLOCKED (files outside mount don't exist)
+#   - Environment variables: NOT SET (host env never forwarded)
+#   - C2 exfiltration: BLOCKED (loopback always denied)
+#   - Cloud metadata: BLOCKED (link-local always denied)
+#   - Persistence: BLOCKED (host dotfiles not mounted)
+run: prepare
+    pyhl run \
+        --mount {{guest_dir}} \
+        --net-allow example.com \
+        -c "import sys; sys.path.insert(0, '/host'); exec(open('/host/victim_app.py').read())"


+        <div class="row"><span class="key">read /host/input.txt</span> <span class="ok">OK</span></div>
+        <div class="row"><span class="key">GET example.com</span> <span class="ok">OK (HTTP 200)</span></div>
+        <div class="row"><span class="key">write /host/output.txt</span> <span class="ok">OK</span></div>


    # ── Summary ──────────────────────────────────────────────────────
    n_files = len(stolen_files)
    n_env = len(stolen_env)
+    n_meta = len(stolen_metadata)

    print()
    print("=" * (W + 2))
    if n_files > 0 or n_env > 0:
        print("  RESULT: Attack SUCCEEDED")
        print(f"    {n_files} credential file(s) stolen")
        print(f"    {n_env} environment variable(s) harvested")
+        print(f"    {n_meta} cloud metadata endpoint(s) reached")
        print(f"    {persistence_count} persistence mechanism(s) installed")


+        except Exception as e:
+            msg = str(e)
+            if "link-local" in msg.lower():
+                print(f"{_dots(name)} BLOCKED (link-local policy)")
+            elif "Input/output error" in msg:
+                print(f"{_dots(name)} BLOCKED (link-local policy)")
+            elif "timed out" in msg or "timeout" in msg.lower():
+                print(f"{_dots(name)} TIMEOUT (no metadata service)")
+            elif "refused" in msg.lower():
+                print(f"{_dots(name)} NOT AVAILABLE")
+            else:
+                print(f"{_dots(name)} BLOCKED")


 A simple application that fetches data from an API.

-The developer installed `reqeusts` instead of `requests` — a common
+The developer installed `reqeusts` instead of `requests` --- a common


+
+    <!-- HYPERLIGHT SANDBOX -->
+    <div class="col col-pass">
+      <div class="col-title">Hyperlight Micro-VM <span class="cap">(--mount ./workspace --net-allow example.com)</span></div>


github-actions

Linux Benchmarks

Details

Benchmark suite	Current: `e1ff469`	Previous: `d8524a9`	Ratio
`hello_world (median)`	`20` ms	`20` ms	`1`
`pandas (median)`	`110` ms	`110` ms	`1`
`density (per VM)`	`7` MB	`7` MB	`1`
`snapshot (disk)`	`385` MiB	`385` MiB	`1`

This comment was automatically generated by workflow using github-action-benchmark.

github-actions

Windows Benchmarks

Details

Benchmark suite	Current: `e1ff469`	Previous: `d8524a9`	Ratio
`hello_world (median)`	`298` ms	`179` ms	`1.66`
`pandas (median)`	`949` ms	`508` ms	`1.87`
`density (per VM)`	`6` MB	`6` MB	`1`
`snapshot (disk)`	`392` MiB	`392` MiB	`1`

This comment was automatically generated by workflow using github-action-benchmark.

- Fix pyhl install path in README (host crate, not tools/) - Fix run-minimal description (mount only, not total isolation) - Fix README wording (mounted directory, not workspace) - Fix graphic: correct mount flag, correct workspace paths - Add metadata to attack success condition - Use structured errno checks instead of string matching - Fix docstring dash Signed-off-by: danbugs <danilochiarlone@gmail.com>

Copilot AI review requested due to automatic review settings May 20, 2026 22:49

Copilot started reviewing on behalf of danbugs May 20, 2026 22:49 View session

Copilot AI reviewed May 20, 2026

View reviewed changes

github-actions Bot reviewed May 20, 2026

View reviewed changes

danbugs enabled auto-merge (squash) May 20, 2026 23:00

danbugs merged commit 860b6a1 into main May 20, 2026
79 checks passed

danbugs deleted the supply-chain-scoped-capabilities branch May 20, 2026 23:11

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Upgrade supply chain demo to scoped capabilities with active defense - #76

Upgrade supply chain demo to scoped capabilities with active defense#76
danbugs merged 2 commits into
mainfrom
supply-chain-scoped-capabilities

danbugs commented May 20, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

github-actions Bot left a comment •

edited

Loading

Uh oh!

github-actions Bot left a comment •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

danbugs commented May 20, 2026

Summary

Test plan

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

github-actions Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Linux Benchmarks

Uh oh!

github-actions Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Windows Benchmarks

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

github-actions Bot left a comment •

edited

Loading

github-actions Bot left a comment •

edited

Loading