Dezh OS F1 Agent-Containment Demo Transcript
Generated by tools/demo/run_agent_demo.py.
Flow: attenuated delegation over IPC; SDK-built agent app installed
with manifest-scoped grants (own Cairn namespace only); in-grant durable
commits; a bad write undone by a one-step rollback (history kept,
hash-verified); a no-capability spy app DENIED by the kernel; state
checked again after a reboot.
OpenSBI v1.7
____ _____ ____ _____
/ __ \ / ____| _ \_ _|
| | | |_ __ ___ _ __ | (___ | |_) || |
| | | | '_ \ / _ \ '_ \ \___ \| _ < | |
| |__| | |_) | __/ | | |____) | |_) || |_
\____/| .__/ \___|_| |_|_____/|____/_____|
| |
|_|
Platform Name : riscv-virtio,qemu
Platform Features : medeleg
Platform HART Count : 1
Platform IPI Device : aclint-mswi
Platform Timer Device : aclint-mtimer @ 10000000Hz
Platform Console Device : uart8250
Platform HSM Device : ---
Platform PMU Device : ---
Platform Reboot Device : syscon-reboot
Platform Shutdown Device : syscon-poweroff
Platform Suspend Device : ---
Platform CPPC Device : ---
Firmware Base : 0x80000000
Firmware Size : 317 KB
Firmware RW Offset : 0x40000
Firmware RW Size : 61 KB
Firmware Heap Offset : 0x46000
Firmware Heap Size : 37 KB (total), 2 KB (reserved), 11 KB (used), 23 KB (free)
Firmware Scratch Size : 4096 B (total), 1400 B (used), 2696 B (free)
Runtime SBI Version : 3.0
Standard SBI Extensions : time,rfnc,ipi,base,hsm,srst,pmu,dbcn,fwft,legacy,dbtr,sse
Experimental SBI Extensions : none
Domain0 Name : root
Domain0 Boot HART : 0
Domain0 HARTs : 0*
Domain0 Region00 : 0x0000000000100000-0x0000000000100fff M: (I,R,W) S/U: (R,W)
Domain0 Region01 : 0x0000000010000000-0x0000000010000fff M: (I,R,W) S/U: (R,W)
Domain0 Region02 : 0x0000000002000000-0x000000000200ffff M: (I,R,W) S/U: ()
Domain0 Region03 : 0x0000000080040000-0x000000008004ffff M: (R,W) S/U: ()
Domain0 Region04 : 0x0000000080000000-0x000000008003ffff M: (R,X) S/U: ()
Domain0 Region05 : 0x000000000c400000-0x000000000c5fffff M: (I,R,W) S/U: (R,W)
Domain0 Region06 : 0x000000000c000000-0x000000000c3fffff M: (I,R,W) S/U: (R,W)
Domain0 Region07 : 0x0000000000000000-0xffffffffffffffff M: () S/U: (R,W,X)
Domain0 Next Address : 0x0000000080200000
Domain0 Next Arg1 : 0x0000000087e00000
Domain0 Next Mode : S-mode
Domain0 SysReset : yes
Domain0 SysSuspend : yes
Boot HART ID : 0
Boot HART Domain : root
Boot HART Priv Version : v1.12
Boot HART Base ISA : rv64imafdch
Boot HART ISA Extensions : sstc,zicntr,zihpm,zicboz,zicbom,sdtrig,svadu
Boot HART PMP Count : 16
Boot HART PMP Granularity : 2 bits
Boot HART PMP Address Bits : 54
Boot HART MHPM Info : 16 (0x0007fff8)
Boot HART Debug Triggers : 2 triggers
Boot HART MIDELEG : 0x0000000000001666
Boot HART MEDELEG : 0x0000000000f4b509
____ _
| _ \ ___ ___| |__
| | | |/ _ \/_ / '_ \
| |_| | __/ / /| | | |
|____/ \___//___|_| |_|
Dezh OS - capability-secure - no ambient authority
v0 - riscv64 - 126 MiB usable - 4 services
[dezh-boot] alive on bare metal (qemu virt, riscv64, S-mode)
[dezh-boot] boot contract VALIDATED
[dezh-boot] banner: dezh-kernel-boot-v0:qemu-virtio-riscv64:services=4:usable_bytes=132120576
[dezh-boot] no ambient authority: capability seeds bound to declared services only
[dezh-boot] installing trap vector + supervisor timer...
[dezh-boot] enabling Sv39 paging (U-mode confined to its own region)...
[dezh-boot] frame allocator: 28672 x 4 KiB frames (112 MiB free)
[dezh-boot] embedded user ELFs: userprog=8952 bytes, virtio-blk=82280 bytes, dezh-bench=15592 bytes, dezh-note=7080 bytes, dezh-lab=17208 bytes, dezh-calc=10440 bytes, dezh-vault=7824 bytes
[dezh-boot] install manifest v0: root=cairn block=virtio-block marker_sector=0
[dezh-boot] service registry built from boot plan (4 services)
Dezh console. Every command requires an explicit capability.
Type 'help'. The console holds: INSPECT TIME ECHO HALT SPAWN
dezh> ipc
[kernel] IPC: a no-authority service + an agent that delegates PRINT to it
[kernel] DENIED print: task 0 holds no PRINT capability
[agent] delegating my PRINT capability to the service over IPC
[kernel] task 1 exited (code 0)
[service] received a delegated PRINT capability via IPC; now I can print:
[service] <payload delivered with a delegated PRINT cap>
[kernel] task 0 exited (code 0)
[kernel] IPC demo done; back in the console
dezh> pkg-recv
[services] starting virtio-block from boot registry as task 0
[virtio-blk-daemon] started as a long-lived U-mode driver service
[virtio-blk-daemon] device + DMA capabilities accepted
[services] virtio-block Running (task 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[pkg-recv] ready: send base64 lines; end with '.', abort with '!'
+ok 30
+ok 60
+ok 90
+ok 120
+ok 150
+ok 180
+ok 210
+ok 240
+ok 270
+ok 300
+ok 330
+ok 360
+ok 390
+ok 420
+ok 450
+ok 480
+ok 510
+ok 540
+ok 570
+ok 600
+ok 630
+ok 660
+ok 690
+ok 720
+ok 750
+ok 780
+ok 810
+ok 840
+ok 870
+ok 900
+ok 930
+ok 960
+ok 990
+ok 1020
+ok 1050
+ok 1080
+ok 1110
+ok 1140
+ok 1170
+ok 1200
+ok 1230
+ok 1260
+ok 1290
+ok 1320
+ok 1350
+ok 1380
+ok 1410
+ok 1440
+ok 1470
+ok 1500
+ok 1530
+ok 1560
+ok 1590
+ok 1620
+ok 1650
+ok 1680
+ok 1710
+ok 1740
+ok 1753
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[virtio-blk-daemon] pkg-store-init status=0
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[pkg] installed 'agent' 0.1.0 kind=dezh-ir payload=1328 bytes persistent_slot=0 state=Active
[pkg] grants recorded at install time: print cairn-read cairn-write (kernel-enforced at run time; persisted on disk)
dezh> pkg-recv
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[pkg-recv] ready: send base64 lines; end with '.', abort with '!'
+ok 30
+ok 60
+ok 90
+ok 108
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[virtio-blk-daemon] pkg-store-init status=0
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[pkg] installed 'spy' 0.1.0 kind=dezh-ir payload=12 bytes persistent_slot=1 state=Active
[pkg] grants recorded at install time: (none) (kernel-enforced at run time; persisted on disk)
dezh> pkg-info agent
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
[kernel] task 1 exited (code 0)
package: agent 0.1.0
state Active runnable=yes
kind dezh-ir
raw 1753 bytes crc=0x5bc04a5
store slot=0 blob_sector=64 sectors=64
GRANTED print cairn-read cairn-write
DENIED ipc uptime + device/DMA/MMIO (never grantable from a manifest)
model grants fixed by verified manifest; no inheritance from console/installer
dezh> pkg-run agent
[pkg-run] 'agent' 0.1.0 kind=dezh-ir caps=print cairn-read cairn-write
[ir] agent online, caps checked by kernel
[cairn] v1 store formatted: superblock sector 1600, 255 commit slots
[cairn] commit ns=agent slot=0 parent=none len=15 hash=0xeaa3bce638240191 actor=task1
[vblk-client] cairn-commit status=0
[kernel] task 1 exited (code 0)
[cairn] commit ns=agent slot=1 parent=0 len=14 hash=0xdf6c9b3bfe5385cf actor=task1
[vblk-client] cairn-commit status=0
[kernel] task 1 exited (code 0)
[cairn] get ns=agent head=1 len=14
[vblk-client] cairn-get status=0
[vblk-client] cairn value = "agent-note-BAD
[kernel] task 1 exited (code 0)
[ir] agent-note-BAD
[pkg-run] 'agent' finished
dezh> cairn-log agent
[cairn] log ns=agent (newest first):
slot=1 parent=0 len=14 hash=0xdf6c9b3bfe5385cf actor=task1 reversible=yes
slot=0 parent=none len=15 hash=0xeaa3bce638240191 actor=task1 reversible=yes
[vblk-client] cairn-log status=0
[kernel] task 1 exited (code 0)
dezh> cairn-rollback agent 1
[cairn] rollback ns=agent steps=1 head 1 -> 0
[cairn] history preserved: rollback moves the ref, commits stay on disk
[vblk-client] cairn-rollback status=0
[kernel] task 1 exited (code 0)
dezh> cairn-get agent
[cairn] get ns=agent head=0 len=15
[vblk-client] cairn-get status=0
[vblk-client] cairn value = "agent-note-good
[kernel] task 1 exited (code 0)
dezh> cairn-verify agent
[cairn] verify ns=agent slot=0 hash MATCH 0xeaa3bce638240191
[vblk-client] cairn-verify status=0
[kernel] task 1 exited (code 0)
dezh> pkg-run spy
[pkg-run] 'spy' 0.1.0 kind=dezh-ir caps=(none)
[pkg-run] DENIED by kernel: missing required capability for this host call (grant it in app.toml caps=[...])
dezh> events
events:
TICK ACTOR ACTION TARGET RESULT
0 installer pkg.tx.start package OK
0 installer pkg.blob.verify package OK
0 installer pkg.registry.pending package OK
0 installer pkg.tx.commit package OK
0 installer pkg.tx.start package OK
0 installer pkg.blob.verify package OK
0 installer pkg.registry.pending package OK
0 installer pkg.tx.commit package OK
0 installer pkg.run package start
0 installer pkg.run package OK
0 console cairn.rollback agent ok
0 installer pkg.run package start
0 kernel pkg.run package DENIED
dezh> halt
halting.
--- reboot ---
OpenSBI v1.7
____ _____ ____ _____
/ __ \ / ____| _ \_ _|
| | | |_ __ ___ _ __ | (___ | |_) || |
| | | | '_ \ / _ \ '_ \ \___ \| _ < | |
| |__| | |_) | __/ | | |____) | |_) || |_
\____/| .__/ \___|_| |_|_____/|____/_____|
| |
|_|
Platform Name : riscv-virtio,qemu
Platform Features : medeleg
Platform HART Count : 1
Platform IPI Device : aclint-mswi
Platform Timer Device : aclint-mtimer @ 10000000Hz
Platform Console Device : uart8250
Platform HSM Device : ---
Platform PMU Device : ---
Platform Reboot Device : syscon-reboot
Platform Shutdown Device : syscon-poweroff
Platform Suspend Device : ---
Platform CPPC Device : ---
Firmware Base : 0x80000000
Firmware Size : 317 KB
Firmware RW Offset : 0x40000
Firmware RW Size : 61 KB
Firmware Heap Offset : 0x46000
Firmware Heap Size : 37 KB (total), 2 KB (reserved), 11 KB (used), 23 KB (free)
Firmware Scratch Size : 4096 B (total), 1400 B (used), 2696 B (free)
Runtime SBI Version : 3.0
Standard SBI Extensions : time,rfnc,ipi,base,hsm,srst,pmu,dbcn,fwft,legacy,dbtr,sse
Experimental SBI Extensions : none
Domain0 Name : root
Domain0 Boot HART : 0
Domain0 HARTs : 0*
Domain0 Region00 : 0x0000000000100000-0x0000000000100fff M: (I,R,W) S/U: (R,W)
Domain0 Region01 : 0x0000000010000000-0x0000000010000fff M: (I,R,W) S/U: (R,W)
Domain0 Region02 : 0x0000000002000000-0x000000000200ffff M: (I,R,W) S/U: ()
Domain0 Region03 : 0x0000000080040000-0x000000008004ffff M: (R,W) S/U: ()
Domain0 Region04 : 0x0000000080000000-0x000000008003ffff M: (R,X) S/U: ()
Domain0 Region05 : 0x000000000c400000-0x000000000c5fffff M: (I,R,W) S/U: (R,W)
Domain0 Region06 : 0x000000000c000000-0x000000000c3fffff M: (I,R,W) S/U: (R,W)
Domain0 Region07 : 0x0000000000000000-0xffffffffffffffff M: () S/U: (R,W,X)
Domain0 Next Address : 0x0000000080200000
Domain0 Next Arg1 : 0x0000000087e00000
Domain0 Next Mode : S-mode
Domain0 SysReset : yes
Domain0 SysSuspend : yes
Boot HART ID : 0
Boot HART Domain : root
Boot HART Priv Version : v1.12
Boot HART Base ISA : rv64imafdch
Boot HART ISA Extensions : sstc,zicntr,zihpm,zicboz,zicbom,sdtrig,svadu
Boot HART PMP Count : 16
Boot HART PMP Granularity : 2 bits
Boot HART PMP Address Bits : 54
Boot HART MHPM Info : 16 (0x0007fff8)
Boot HART Debug Triggers : 2 triggers
Boot HART MIDELEG : 0x0000000000001666
Boot HART MEDELEG : 0x0000000000f4b509
____ _
| _ \ ___ ___| |__
| | | |/ _ \/_ / '_ \
| |_| | __/ / /| | | |
|____/ \___//___|_| |_|
Dezh OS - capability-secure - no ambient authority
v0 - riscv64 - 126 MiB usable - 4 services
[dezh-boot] alive on bare metal (qemu virt, riscv64, S-mode)
[dezh-boot] boot contract VALIDATED
[dezh-boot] banner: dezh-kernel-boot-v0:qemu-virtio-riscv64:services=4:usable_bytes=132120576
[dezh-boot] no ambient authority: capability seeds bound to declared services only
[dezh-boot] installing trap vector + supervisor timer...
[dezh-boot] enabling Sv39 paging (U-mode confined to its own region)...
[dezh-boot] frame allocator: 28672 x 4 KiB frames (112 MiB free)
[dezh-boot] embedded user ELFs: userprog=8952 bytes, virtio-blk=82280 bytes, dezh-bench=15592 bytes, dezh-note=7080 bytes, dezh-lab=17208 bytes, dezh-calc=10440 bytes, dezh-vault=7824 bytes
[dezh-boot] install manifest v0: root=cairn block=virtio-block marker_sector=0
[dezh-boot] service registry built from boot plan (4 services)
Dezh console. Every command requires an explicit capability.
Type 'help'. The console holds: INSPECT TIME ECHO HALT SPAWN
dezh> cairn-get agent
[services] starting virtio-block from boot registry as task 0
[virtio-blk-daemon] started as a long-lived U-mode driver service
[virtio-blk-daemon] device + DMA capabilities accepted
[services] virtio-block Running (task 0)
[cairn] get ns=agent head=0 len=15
[vblk-client] cairn-get status=0
[vblk-client] cairn value = "agent-note-good
[kernel] task 1 exited (code 0)
dezh> cairn-verify agent
[cairn] verify ns=agent slot=0 hash MATCH 0xeaa3bce638240191
[vblk-client] cairn-verify status=0
[kernel] task 1 exited (code 0)
dezh> halt
halting.