Release v2.6.0 (#346)

step-security · Oct 3, 2023 · 1b05615 · 1b05615
1 parent 398bb08
commit 1b05615
Show file tree

Hide file tree

Showing 17 changed files with 115 additions and 31 deletions.
diff --git a/README.md b/README.md
diff --git a/action.yml b/action.yml
@@ -1,5 +1,5 @@
-name: "Harden Runner"
-description: "Security agent for GitHub-hosted runner to monitor the build process"
+name: "Harden-Runner"
+description: "Harden-Runner provides runtime security for GitHub-hosted and self-hosted runners"
 inputs:
   allowed-endpoints:
     description: "Only these endpoints will be allowed if egress-policy is set to block"

diff --git a/dist/index.js b/dist/index.js
diff --git a/dist/index.js.map b/dist/index.js.map
diff --git a/dist/post/index.js b/dist/post/index.js
@@ -61261,6 +61261,7 @@ function addSummary() {
 const STATUS_HARDEN_RUNNER_UNAVAILABLE = "409";
 const CONTAINER_MESSAGE = "This job is running in a container. Harden Runner does not run in a container as it needs sudo access to run. This job will not be monitored.";
 const UBUNTU_MESSAGE = "This job is not running in a GitHub Actions Hosted Runner Ubuntu VM. Harden Runner is only supported on Ubuntu VM. This job will not be monitored.";
+const SELF_HOSTED_NO_AGENT_MESSAGE = "This job is running on a self-hosted runner, but the runner does not have Harden-Runner installed. This job will not be monitored.";
 const HARDEN_RUNNER_UNAVAILABLE_MESSAGE = "Sorry, we are currently experiencing issues with the Harden Runner installation process. It is currently unavailable.";
 const ARC_RUNNER_MESSAGE = "Workflow is currently being executed in ARC based runner";
 
@@ -61400,6 +61401,9 @@ var cleanup_awaiter = (undefined && undefined.__awaiter) || function (thisArg, _
         removeStepPolicyFiles();
         return;
     }
+    if (process.env.STATE_selfHosted === "true") {
+        return;
+    }
     if (String(process.env.STATE_monitorStatusCode) ===
         STATUS_HARDEN_RUNNER_UNAVAILABLE) {
         console.log(HARDEN_RUNNER_UNAVAILABLE_MESSAGE);

diff --git a/dist/post/index.js.map b/dist/post/index.js.map
diff --git a/dist/pre/index.js b/dist/pre/index.js
diff --git a/dist/pre/index.js.map b/dist/pre/index.js.map
diff --git a/images/Insights4.png b/images/Insights4.png
diff --git a/images/block-outbound-call.png b/images/block-outbound-call.png
diff --git a/images/blocked-outbound-call-2.png b/images/blocked-outbound-call-2.png
diff --git a/images/file-overwritten.png b/images/file-overwritten.png
diff --git a/images/fileoverwrite.png b/images/fileoverwrite.png
diff --git a/images/insights-5.png b/images/insights-5.png
diff --git a/src/cleanup.ts b/src/cleanup.ts
@@ -37,6 +37,10 @@ import { arcCleanUp, isArcRunner, removeStepPolicyFiles } from "./arc-runner";
     return;
   }
 
+  if (process.env.STATE_selfHosted === "true") {
+    return;
+  }
+
   if (
     String(process.env.STATE_monitorStatusCode) ===
     common.STATUS_HARDEN_RUNNER_UNAVAILABLE

diff --git a/src/common.ts b/src/common.ts
@@ -164,6 +164,9 @@ export const CONTAINER_MESSAGE =
 export const UBUNTU_MESSAGE =
   "This job is not running in a GitHub Actions Hosted Runner Ubuntu VM. Harden Runner is only supported on Ubuntu VM. This job will not be monitored.";
 
+export const SELF_HOSTED_NO_AGENT_MESSAGE =
+  "This job is running on a self-hosted runner, but the runner does not have Harden-Runner installed. This job will not be monitored.";
+
 export const HARDEN_RUNNER_UNAVAILABLE_MESSAGE =
   "Sorry, we are currently experiencing issues with the Harden Runner installation process. It is currently unavailable.";
 

diff --git a/src/setup.ts b/src/setup.ts
@@ -134,6 +134,31 @@ import { isArcRunner, sendAllowedEndpoints } from "./arc-runner";
       return;
     }
 
+    const runnerName = process.env.RUNNER_NAME || "";
+    core.info(`RUNNER_NAME: ${runnerName}`);
+    if (!runnerName.startsWith("GitHub Actions")) {
+      fs.appendFileSync(process.env.GITHUB_STATE, `selfHosted=true${EOL}`, {
+        encoding: "utf8",
+      });
+      if (!fs.existsSync("/home/agent/agent")) {
+        core.info(common.SELF_HOSTED_NO_AGENT_MESSAGE);
+        return;
+      }
+      if (confg.egress_policy === "block") {
+        try {
+          if (process.env.USER) {
+            cp.execSync(`sudo chown -R ${process.env.USER} /home/agent`);
+          }
+          const confgStr = JSON.stringify(confg);
+          fs.writeFileSync("/home/agent/block_event.json", confgStr);
+          await sleep(5000);
+        } catch (error) {
+          core.info(`[!] Unable to write block_event.json: ${error}`);
+        }
+      }
+      return;
+    }
+
     let _http = new httpm.HttpClient();
     let statusCode;
     _http.requestOptions = { socketTimeout: 3 * 1000 };