Collect the BlueField SNAP-4 container version and grade it per release train

README.md

@@ -221,6 +221,7 @@ audit_profile:
   - securityVersions.connectxFirmware.status
   - securityVersions.dcgm.status
   - securityVersions.dcgmExporter.status
+  - securityVersions.snap4Container.status
   - securityVersions.virtioNetBluefield.status
   - securityVersions.virtioNetBluefield.exposure
   - securityVersions.dpuHostIsolation.status

README_zh.md

@@ -129,6 +129,7 @@ audit_profile:
   - securityVersions.connectxFirmware.status
   - securityVersions.dcgm.status
   - securityVersions.dcgmExporter.status
+  - securityVersions.snap4Container.status
   - securityVersions.virtioNetBluefield.status
   - securityVersions.virtioNetBluefield.exposure
   - securityVersions.dpuHostIsolation.status

cmax/audit_profiles.py

@@ -32,6 +32,7 @@ def includes(self, key: str) -> bool:
                 "securityVersions.dcgm.status",
                 "securityVersions.dcgmExporter.status",
                 "securityVersions.virtioNetBluefield.status",
+                "securityVersions.snap4Container.status",
             }
         ),
     ),

cmax/audit_report.py

@@ -112,6 +112,9 @@ def _harness_not_applicable(harness: str) -> str:
     "securityVersions.virtioNetBluefield.status": (
         "The BlueField VIRTIO-Net controller meets the published security minimum."
     ),
+    "securityVersions.snap4Container.status": (
+        "The BlueField SNAP-4 container meets the published security minimum for its release train."
+    ),
     "securityVersions.dpuHostIsolation.status": (
         "The host cannot reach the BlueField DPU control plane through the checked interfaces."
     ),
@@ -299,6 +302,7 @@ def _title(key: str) -> str:
         "Rdma": "RDMA",
         "Hca": "HCA",
         "Dpu": "DPU",
+        "Snap4": "SNAP-4",
         "Dcgm": "DCGM",
         "Smmu": "SMMU",
         "Iommu": "IOMMU",
@@ -373,6 +377,11 @@ def _title(key: str) -> str:
         "custom-columns='NAMESPACE:.metadata.namespace,NAME:.metadata.name,"
         "IMAGES:.spec.containers[*].image' | grep -i dcgm-exporter`"
     ),
+    "securityVersions.snap4Container.status": (
+        "on each BlueField-3 DPU in DPU mode (locally or over RShim with "
+        "`ssh ubuntu@192.168.100.2`): `sudo crictl ps` and `sudo crictl images "
+        "| grep doca_snap`, or `grep -i 'image:.*doca_snap' /etc/kubelet.d/*`"
+    ),
     "securityVersions.dpuHostIsolation.status": (
         "on every BlueField GPU worker: read `INTERNAL_CPU_RSHIM` with "
         "`sudo -n mlxconfig -d <PCI-address> q`, inspect `/dev/rshim*`, and "

cmax/criteria_links.py

@@ -93,6 +93,7 @@
     "securityVersions.connectxFirmware.status": _SECURITY_PATCHING,
     "securityVersions.dcgm.status": _SECURITY_PATCHING,
     "securityVersions.dcgmExporter.status": _SECURITY_PATCHING,
+    "securityVersions.snap4Container.status": _SECURITY_PATCHING,
     "securityVersions.virtioNetBluefield.status": _SECURITY_PATCHING,
     "securityVersions.virtioNetBluefield.exposure": _SECURITY_ISOLATION,
     "securityVersions.dpuHostIsolation.status": _SECURITY_ISOLATION,

cmax/minimum_links.py

@@ -21,6 +21,7 @@
         "rocm",
         "dcgm",
         "dcgmExporter",
+        "snap4Container",
         "ubuntuNoble",
     }
 )
@@ -33,6 +34,7 @@
     "docker": "docker",
     "connectx-firmware": "connectxFirmware",
     "virtio-net-bluefield": "virtioNetBluefield",
+    "snap4-container": "snap4Container",
     "fragnesia": "ubuntuNoble",
 }
 

cmax/scripts/1-audit/audit-common.sh

@@ -453,7 +453,7 @@ version_meets_minimum() {
 # which grades as a warning, instead of "fail", which grades as critical: a
 # machine proven vulnerable would be softened because a different machine was
 # unreadable.
-VIRTIO_NET_SUMMARY_KEYS="virtioNet virtioNetLine virtioNetMode virtioNetSource virtioNetReason dpuIsolationJson state virtioNetWorstObserved virtioNetWorstObservedLine virtioNetWorstObservedMode virtioNetWorstObservedHost virtioNetObservedJson"
+VIRTIO_NET_SUMMARY_KEYS="virtioNet virtioNetLine virtioNetMode virtioNetSource virtioNetReason dpuIsolationJson state virtioNetWorstObserved virtioNetWorstObservedLine virtioNetWorstObservedMode virtioNetWorstObservedHost virtioNetObservedJson snap4Json"
 
 # virtio_net_check_facts - resolve the BlueField VIRTIO-Net controller state.
 #
@@ -464,6 +464,8 @@ VIRTIO_NET_SUMMARY_KEYS="virtioNet virtioNetLine virtioNetMode virtioNetSource v
 #   VIRTIO_NET_SOURCE         --virtio-net-source  (how the version was read)
 #   VIRTIO_NET_REASON         --virtio-net-reason  (why it was not read)
 #   VIRTIO_NET_ISOLATION_JSON --dpu-isolation-json (the RShim posture evidence)
+#   SNAP4_JSON                --snap4-json         (the SNAP-4 container rollup,
+#                                                   read on the same DPU path)
 # plus VIRTIO_NET_STATE for the operator log.
 #
 # The check self-dispatches per node, because a DPU is per node and a head-node
@@ -490,6 +492,7 @@ virtio_net_check_facts() {
     VIRTIO_NET_WORST_MODE=""
     VIRTIO_NET_WORST_HOST=""
     VIRTIO_NET_OBSERVED_JSON=""
+    SNAP4_JSON=""
 
     local check="${WORKLOAD_DIR:-$AUDIT_COMMON_DIR}/checks/fabric/virtio-net-check.py"
     [[ -f "$check" ]] || check="${AUDIT_COMMON_DIR}/checks/fabric/virtio-net-check.py"
@@ -542,6 +545,7 @@ for key in sys.argv[1:]:
             9) VIRTIO_NET_WORST_MODE="$line" ;;
             10) VIRTIO_NET_WORST_HOST="$line" ;;
             11) VIRTIO_NET_OBSERVED_JSON="$line" ;;
+            12) SNAP4_JSON="$line" ;;
         esac
         index=$((index + 1))
     done <<< "$parsed"
@@ -688,6 +692,7 @@ build_security_version_audit() {
         VIRTIO_NET_WORST_HOST=""
         VIRTIO_NET_OBSERVED_JSON=""
         VIRTIO_NET_ISOLATION_JSON=""
+        SNAP4_JSON='{"state":"not_applicable","reason":"scale-out checks do not apply to standalone","observed":[]}'
     else
         virtio_net_check_facts
     fi
@@ -713,9 +718,10 @@ build_security_version_audit() {
         && args+=(--virtio-net-observed-json "$VIRTIO_NET_OBSERVED_JSON")
     [[ -n "$VIRTIO_NET_ISOLATION_JSON" ]] \
         && args+=(--dpu-isolation-json "$VIRTIO_NET_ISOLATION_JSON")
+    [[ -n "$SNAP4_JSON" ]] && args+=(--snap4-json "$SNAP4_JSON")
 
     if [[ ! -f "$policy" ]] || ! command -v python3 >/dev/null 2>&1; then
-        printf '%s\n' '{"amdDriver":{"status":"unknown"},"nvidiaDriver":{"status":"unknown"},"nvidiaContainerToolkit":{"status":"unknown"},"cudaToolkit":{"status":"unknown"},"docker":{"status":"unknown"},"runc":{"status":"unknown"},"connectxFirmware":{"status":"unknown"},"dcgm":{"status":"unknown"},"dcgmExporter":{"status":"unknown"},"virtioNetBluefield":{"status":"unknown"},"dpuHostIsolation":{"status":"unknown"}}'
+        printf '%s\n' '{"amdDriver":{"status":"unknown"},"nvidiaDriver":{"status":"unknown"},"nvidiaContainerToolkit":{"status":"unknown"},"cudaToolkit":{"status":"unknown"},"docker":{"status":"unknown"},"runc":{"status":"unknown"},"connectxFirmware":{"status":"unknown"},"dcgm":{"status":"unknown"},"dcgmExporter":{"status":"unknown"},"virtioNetBluefield":{"status":"unknown"},"dpuHostIsolation":{"status":"unknown"},"snap4Container":{"status":"unknown"}}'
         return 0
     fi
 
@@ -760,7 +766,7 @@ build_security_version_audit() {
     done <<< "$check_output"
 
     python3 "$policy" "${args[@]}" 2>/dev/null \
-        || printf '%s\n' '{"amdDriver":{"status":"unknown"},"nvidiaDriver":{"status":"unknown"},"nvidiaContainerToolkit":{"status":"unknown"},"cudaToolkit":{"status":"unknown"},"docker":{"status":"unknown"},"runc":{"status":"unknown"},"connectxFirmware":{"status":"unknown"},"dcgm":{"status":"unknown"},"dcgmExporter":{"status":"unknown"},"virtioNetBluefield":{"status":"unknown"},"dpuHostIsolation":{"status":"unknown"}}'
+        || printf '%s\n' '{"amdDriver":{"status":"unknown"},"nvidiaDriver":{"status":"unknown"},"nvidiaContainerToolkit":{"status":"unknown"},"cudaToolkit":{"status":"unknown"},"docker":{"status":"unknown"},"runc":{"status":"unknown"},"connectxFirmware":{"status":"unknown"},"dcgm":{"status":"unknown"},"dcgmExporter":{"status":"unknown"},"virtioNetBluefield":{"status":"unknown"},"dpuHostIsolation":{"status":"unknown"},"snap4Container":{"status":"unknown"}}'
 }
 
 amd_gpu_check_present() {

cmax/scripts/1-audit/audit_findings.py

@@ -507,6 +507,12 @@ def _bluefield_observed(audit: dict[str, Any]) -> bool:
     )
 
 
+def _isolation_nic_mode(audit: dict[str, Any]) -> bool:
+    """True when every host with an unrestricted RShim read NIC mode."""
+    mode = nested_get(audit, "securityVersions", "dpuHostIsolation", "platformMode")
+    return str(mode or "").strip().lower() == "nic"
+
+
 def _bluefield_absence_proven(audit: dict[str, Any]) -> bool:
     """True only when a completed inventory found no BlueField device."""
     isolation = nested_get(audit, "securityVersions", "dpuHostIsolation")
@@ -751,6 +757,22 @@ def _tenant_pod_guidance(
         CONFIG,
         _status_is("unknown"),
     ),
+    # SNAP-4 runs on the DPU Arm side, so it is graded only where the DPU is
+    # part of the audited fabric, the same scope as the virtio-net controller.
+    Rule(
+        "securityVersions.snap4Container.status",
+        "BlueField SNAP-4 container below security minimum",
+        VERSION,
+        _status_is("fail"),
+        harnesses=SCALE_OUT_HARNESSES,
+    ),
+    Rule(
+        "securityVersions.snap4Container.status",
+        "BlueField SNAP-4 container version requires provider attestation",
+        CONFIG,
+        _status_is("unknown"),
+        harnesses=SCALE_OUT_HARNESSES,
+    ),
     # --- BlueField DPU ----------------------------------------------------
     # The controller firmware check has four reportable states, not two. A
     # below-minimum controller in DPU mode is running and fails. The same firmware
@@ -857,6 +879,18 @@ def _tenant_pod_guidance(
         "--disable_counter_rd --disable_port_owner",
         CONFIG,
         _status_is("fail"),
+        guard=lambda audit: not _isolation_nic_mode(audit),
+        harnesses=SCALE_OUT_HARNESSES,
+    ),
+    Rule(
+        "securityVersions.dpuHostIsolation.status",
+        "Host side can open RShim to the BlueField (NIC mode, "
+        "INTERNAL_CPU_RSHIM=0); keep tenant host root off the card or "
+        "re-image it per tenant, not mlxprivhost, which NVIDIA does not "
+        "support in NIC mode",
+        CONFIG,
+        _status_is("fail"),
+        guard=_isolation_nic_mode,
         harnesses=SCALE_OUT_HARNESSES,
     ),
     Rule(
@@ -1640,6 +1674,8 @@ def classify_suppression(key: str, audit: dict[str, Any]) -> tuple[str, str]:
     "securityVersions.connectxFirmware.status": "security-connectx-firmware",
     "securityVersions.dcgm.status": None,
     "securityVersions.dcgmExporter.status": None,
+    # CLI-only until the criteria catalog has a SNAP-4 criterion.
+    "securityVersions.snap4Container.status": None,
     "securityVersions.virtioNetBluefield.status": "security-virtio-net-bluefield",
     "securityVersions.virtioNetBluefield.exposure": "security-virtio-net-bluefield",
     "securityVersions.dpuHostIsolation.status": "security-dpu-host-isolation",
@@ -1738,6 +1774,7 @@ def _audit_data(values: dict[str, Any]) -> dict[str, Any]:
     "nvidiaContainerToolkit": "NVIDIA Container Toolkit",
     "nvidiaDriver": "NVIDIA driver",
     "runc": "runc",
+    "snap4Container": "BlueField SNAP-4 container",
     "virtioNetBluefield": "BlueField VIRTIO-Net controller",
 }
 
@@ -1915,11 +1952,31 @@ def _finding_guidance(
             "mlxprivhost -d <device> r --disable_rshim --disable_tracer "
             "--disable_counter_rd --disable_port_owner"
         )
-        recommendation = (
-            "Apply zero-trust mode on every affected BlueField with "
-            f"`{remediation}`. Then verify that `INTERNAL_CPU_RSHIM=1`, "
-            "`/dev/rshim0` is absent, and `tmfifo_net0` is absent."
+        nic_mode = (
+            isinstance(isolation, dict)
+            and str(isolation.get("platformMode") or "").strip().lower() == "nic"
         )
+        if nic_mode:
+            # NVIDIA does not support the zero-trust profile in NIC mode.
+            recommendation = (
+                "Two ways to make this real isolation, not just a setting a "
+                "tenant can undo. Either keep tenant host root off the "
+                "BlueField (sudo -M, mdev-coldplug, or an IOMMU/ACS isolation "
+                "of the PCI function), so only the provider can reach it. Or "
+                "accept that a tenant can own the card and re-image it from a "
+                "known-good BFB before each new tenant and after each one "
+                "leaves. `mlxconfig -d <device> s INTERNAL_CPU_RSHIM=1` plus a "
+                "power cycle is real only under the first path; NVIDIA does not "
+                "support the zero-trust mlxprivhost profile in NIC mode. Then "
+                "verify that `INTERNAL_CPU_RSHIM=1`, `/dev/rshim0` is absent, "
+                "and `tmfifo_net0` is absent."
+            )
+        else:
+            recommendation = (
+                "Apply zero-trust mode on every affected BlueField with "
+                f"`{remediation}`. Then verify that `INTERNAL_CPU_RSHIM=1`, "
+                "`/dev/rshim0` is absent, and `tmfifo_net0` is absent."
+            )
     elif (
         rule.key == "securityVersions.dpuHostIsolation.status"
         and str(value).strip().lower() == "unknown"