Skip to content

Commit b033b05

Browse files
Dobbyclaude
andcommitted
feat(verify): add step [6/6] Azure VM Extensions check
Queries IMDS allowExtensionOperations — PASS when false (prod), WARN when true (staging, extensions enabled for debugging). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
1 parent e9f1300 commit b033b05

File tree

1 file changed

+22
-1
lines changed

1 file changed

+22
-1
lines changed

privateclaw

Lines changed: 22 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -106,13 +106,14 @@ EOFEVIDENCE
106106
# 3. Host Key Binding — SSH host key hash matches boot-time record
107107
# 4. Inference Provider — endpoint reachable + attestation header
108108
# 5. Access Lockout — SSH keys + firewall
109+
# 6. VM Extensions — Azure Guest Agent extensions disabled
109110
# ---------------------------------------------------------------------------
110111
cmd_verify() {
111112
echo ""
112113
echo "=== PrivateClaw TEE Verification ==="
113114
echo ""
114115

115-
TOTAL_CHECKS=5
116+
TOTAL_CHECKS=6
116117
PASS_COUNT=0
117118
FAIL_COUNT=0
118119

@@ -595,6 +596,26 @@ PYEOF
595596
fi
596597
echo ""
597598

599+
# ==========================================================================
600+
# Check 6: Azure VM Extensions (Guest Agent)
601+
# ==========================================================================
602+
echo "[6/$TOTAL_CHECKS] VM Extensions"
603+
EXTENSIONS_ALLOWED=$(curl -sf -H "Metadata: true" \
604+
"http://169.254.169.254/metadata/instance/compute/osProfile/allowExtensionOperations?api-version=2021-02-01&format=text" 2>/dev/null || echo "unknown")
605+
echo " Extensions: allowExtensionOperations=$EXTENSIONS_ALLOWED"
606+
if [ "$EXTENSIONS_ALLOWED" = "false" ]; then
607+
echo " Status: PASS"
608+
PASS_COUNT=$((PASS_COUNT + 1))
609+
elif [ "$EXTENSIONS_ALLOWED" = "true" ]; then
610+
echo " Status: WARN (Azure VM extensions are enabled — operator can execute commands via az vm run-command)"
611+
echo " Expected to WARN on staging (extensions enabled for debugging), PASS on prod"
612+
FAIL_COUNT=$((FAIL_COUNT + 1))
613+
else
614+
echo " Status: WARN (could not query IMDS for extension status)"
615+
FAIL_COUNT=$((FAIL_COUNT + 1))
616+
fi
617+
echo ""
618+
598619
# -- Summary --
599620
echo "---"
600621
if [ "$FAIL_COUNT" -eq 0 ]; then

0 commit comments

Comments
 (0)