Isolatie van AI-workloads

import subprocess
import json
from typing import Dict, List
 
class ContainerSecurityAuditor:
    """Audit container security configuration for AI workloads."""
 
    def __init__(self, container_id: str):
        self.container_id = container_id
 
    def inspect_container(self) -> Dict:
        """Retrieve container configuration."""
        result = subprocess.run(
            ["docker", "inspect", self.container_id],
            capture_output=True, text=True, check=True,
        )
        return json.loads(result.stdout)[0]
 
    def check_gpu_isolation(self) -> List[Dict]:
        """Check for GPU isolation weaknesses in the container configuration."""
        config = self.inspect_container()
        findings = []
 
        # Controleer op privileged-modus
        if config.get("HostConfig", {}).get("Privileged", False):
            findings.append({
                "severity": "critical",
                "finding": "Container running in privileged mode",
                "detail": "Privileged mode disables all container isolation. "
                         "GPU workloads should use --gpus flag instead.",
                "remediation": "Use 'docker run --gpus device=0' instead of '--privileged'",
            })
 
        # Controleer op device-mappings
        devices = config.get("HostConfig", {}).get("Devices", []) or []
        nvidia_devices = [d for d in devices if "nvidia" in str(d)]
        if nvidia_devices:
            findings.append({
                "severity": "medium",
                "finding": f"Direct NVIDIA device access: {len(nvidia_devices)} devices",
                "detail": "Direct device mapping bypasses NVIDIA container toolkit isolation",
                "remediation": "Use NVIDIA container toolkit with --gpus flag",
            })
 
        # Controleer op host-PID-namespace
        if config.get("HostConfig", {}).get("PidMode") == "host":
            findings.append({
                "severity": "high",
                "finding": "Container shares host PID namespace",
                "detail": "Host PID namespace allows observing GPU processes from other containers",
                "remediation": "Remove --pid=host flag",
            })
 
        # Controleer seccomp-profiel
        seccomp = config.get("HostConfig", {}).get("SecurityOpt", [])
        if any("seccomp=unconfined" in str(s) for s in seccomp):
            findings.append({
                "severity": "high",
                "finding": "Seccomp profile disabled",
                "detail": "Unconfined seccomp allows all syscalls including ioctl for GPU manipulation",
                "remediation": "Apply a custom seccomp profile that allows required GPU ioctls only",
            })
 
        # Controleer op SYS_ADMIN-capability
        caps = config.get("HostConfig", {}).get("CapAdd", []) or []
        if "SYS_ADMIN" in caps:
            findings.append({
                "severity": "high",
                "finding": "SYS_ADMIN capability granted",
                "detail": "SYS_ADMIN enables mount namespace escapes and device access",
                "remediation": "Remove SYS_ADMIN and use specific capabilities instead",
            })
 
        return findings

#!/bin/bash
# Audit NVIDIA container toolkit configuration
# Run on the host system
 
echo "=== NVIDIA Container Toolkit Security Audit ==="
 
# Controleer toolkit-versie
echo "[*] NVIDIA Container Toolkit version:"
nvidia-container-cli --version 2>/dev/null || echo "  Not found"
 
# Controleer of CDI (Container Device Interface) is ingeschakeld
echo "[*] CDI configuration:"
if [ -f /etc/nvidia-container-runtime/config.toml ]; then
    grep -i "cdi" /etc/nvidia-container-runtime/config.toml
else
    echo "  Config file not found"
fi
 
# Controleer GPU-isolatiemodus
echo "[*] GPU isolation mode:"
nvidia-smi -q | grep -i "MIG\|isolation\|accounting" || echo "  Could not query GPU"
 
# Controleer of MIG (Multi-Instance GPU) beschikbaar en ingeschakeld is
echo "[*] MIG (Multi-Instance GPU) status:"
nvidia-smi mig -lgi 2>/dev/null || echo "  MIG not available on this GPU"
 
# Controleer op IOMMU (vereist voor DMA-bescherming)
echo "[*] IOMMU status:"
if dmesg | grep -qi "IOMMU enabled"; then
    echo "  IOMMU is enabled (good)"
else
    echo "  WARNING: IOMMU may not be enabled"
fi
 
# Lijst alle NVIDIA-devicebestanden op
echo "[*] NVIDIA device files:"
ls -la /dev/nvidia* 2>/dev/null || echo "  No NVIDIA devices found"

import subprocess
import json
from typing import List, Dict
 
class MIGSecurityManager:
    """Manage and audit MIG instances for workload isolation."""
 
    def list_mig_instances(self) -> List[Dict]:
        """List all MIG GPU instances and their configuration."""
        result = subprocess.run(
            ["nvidia-smi", "mig", "-lgi"],
            capture_output=True, text=True,
        )
        # Parse nvidia-smi-uitvoer
        instances = []
        for line in result.stdout.strip().split("\n"):
            if "MIG" in line or "GPU" in line:
                instances.append({"raw": line.strip()})
        return instances
 
    def verify_memory_isolation(self, instance_id: int) -> Dict:
        """
        Verify that a MIG instance cannot access memory from other instances.
        Returns test results.
        """
        # Deze test wijst geheugen toe op de ene MIG-instance en verifieert
        # dat het niet vanaf een andere instance kan worden gelezen
        test_script = f"""
import torch
import os
os.environ["CUDA_VISIBLE_DEVICES"] = "MIG-{instance_id}"
# Allocate and fill a tensor with known pattern
t = torch.full((1024, 1024), 42.0, device="cuda")
print(f"Allocated on MIG instance {instance_id}: {{t.sum().item()}}")
# Free the tensor
del t
torch.cuda.empty_cache()
"""
        result = subprocess.run(
            ["python3", "-c", test_script],
            capture_output=True, text=True, timeout=30,
        )
        return {
            "instance_id": instance_id,
            "success": result.returncode == 0,
            "output": result.stdout.strip(),
            "error": result.stderr.strip() if result.returncode != 0 else None,
        }

#!/bin/bash
# Configure SR-IOV for NVIDIA GPU (A100 example)
# Must be run on the bare-metal host with root privileges
 
# Schakel SR-IOV in op het GPU-PCI-device
GPU_PCI_ID="0000:3b:00.0"  # Voorbeeld — vind met lspci | grep NVIDIA
 
echo "=== Configuring GPU SR-IOV ==="
 
# Controleer of SR-IOV wordt ondersteund
echo "[*] Checking SR-IOV capability:"
lspci -vvv -s "$GPU_PCI_ID" | grep -i "single root"
 
# Schakel virtuele functies in (bijv. 4 VF's)
echo 4 > "/sys/bus/pci/devices/$GPU_PCI_ID/sriov_numvfs"
 
# Verifieer dat de VF's zijn aangemaakt
echo "[*] Virtual functions:"
lspci | grep -i nvidia | grep "Virtual Function"
 
# Wijs VF's toe aan VM's met VFIO
echo "[*] Binding VF to VFIO driver for VM assignment:"
VF_PCI_ID="0000:3b:00.1"  # Eerste VF
echo "vfio-pci" > "/sys/bus/pci/devices/$VF_PCI_ID/driver_override"
echo "$VF_PCI_ID" > /sys/bus/pci/drivers/vfio-pci/bind

from typing import Dict, Any
import hashlib
 
class TEEAttestationVerifier:
    """
    Verify TEE attestation for AI workloads.
    Ensures the inference environment is genuine and unmodified.
    """
 
    def __init__(self, expected_measurements: Dict[str, str]):
        """
        Args:
            expected_measurements: Expected hash values for TEE measurements.
                Keys are measurement names (e.g., 'mrenclave', 'mrsigner'),
                values are expected hex-encoded hash values.
        """
        self.expected = expected_measurements
 
    def verify_sgx_attestation(self, attestation_report: Dict[str, Any]) -> Dict:
        """Verify an Intel SGX attestation report."""
        results = {"verified": True, "checks": []}
 
        # Verifieer MRENCLAVE (hash van de enclave-code en initiële data)
        mrenclave = attestation_report.get("mrenclave", "")
        if mrenclave != self.expected.get("mrenclave", ""):
            results["verified"] = False
            results["checks"].append({
                "check": "mrenclave",
                "status": "FAIL",
                "detail": "Enclave measurement does not match expected value. "
                         "The inference code may have been modified.",
            })
        else:
            results["checks"].append({
                "check": "mrenclave",
                "status": "PASS",
            })
 
        # Verifieer MRSIGNER (hash van de enclave-signing-sleutel)
        mrsigner = attestation_report.get("mrsigner", "")
        if mrsigner != self.expected.get("mrsigner", ""):
            results["verified"] = False
            results["checks"].append({
                "check": "mrsigner",
                "status": "FAIL",
                "detail": "Signer identity does not match. "
                         "The enclave was not signed by the expected party.",
            })
        else:
            results["checks"].append({
                "check": "mrsigner",
                "status": "PASS",
            })
 
        # Controleer op debug-modus (zou uitgeschakeld moeten zijn in productie)
        if attestation_report.get("attributes", {}).get("debug", False):
            results["verified"] = False
            results["checks"].append({
                "check": "debug_mode",
                "status": "FAIL",
                "detail": "Enclave is running in debug mode. "
                         "Memory can be inspected by the host.",
            })
 
        return results
 
    def verify_model_integrity_in_tee(
        self, model_bytes: bytes, expected_hash: str
    ) -> bool:
        """Verify model integrity inside the TEE before loading."""
        actual_hash = hashlib.sha256(model_bytes).hexdigest()
        return actual_hash == expected_hash

#!/bin/bash
# Discover the isolation architecture of the target AI infrastructure
 
echo "=== AI Workload Isolation Assessment ==="
 
# Bepaal of we in een container draaien
echo "[*] Container detection:"
if [ -f /.dockerenv ]; then
    echo "  Running inside Docker container"
elif grep -q "containerd" /proc/1/cgroup 2>/dev/null; then
    echo "  Running inside containerd"
elif [ -f /run/secrets/kubernetes.io ]; then
    echo "  Running inside Kubernetes pod"
else
    echo "  Not detected as container"
fi
 
# Controleer GPU-toegangsmethode
echo "[*] GPU access method:"
if [ -e /dev/nvidia0 ]; then
    echo "  Direct GPU device access"
    ls -la /dev/nvidia*
fi
 
# Controleer op MIG
echo "[*] MIG configuration:"
nvidia-smi mig -lgi 2>/dev/null || echo "  MIG not available/enabled"
 
# Controleer capabilities
echo "[*] Container capabilities:"
cat /proc/self/status | grep -i cap
 
# Controleer mount-namespace
echo "[*] Mount namespace:"
ls -la /proc/self/ns/mnt
 
# Controleer op gedeeld GPU-geheugen dat toegankelijk is vanuit deze context
echo "[*] GPU memory status:"
nvidia-smi --query-gpu=memory.used,memory.free --format=csv 2>/dev/null