Skip to content

Commit eb47845

Browse files
h0x0erh0x0er
committed
self-hosted: refactored block-policy apply logic
1 parent 1705d77 commit eb47845

File tree

10 files changed

+76
-69
lines changed

10 files changed

+76
-69
lines changed

‎dist/index.js

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27752,7 +27752,7 @@ function addSummary() {
2775227752
const STATUS_HARDEN_RUNNER_UNAVAILABLE = "409";
2775327753
const CONTAINER_MESSAGE = "This job is running in a container. Harden Runner does not run in a container as it needs sudo access to run. This job will not be monitored.";
2775427754
const UBUNTU_MESSAGE = "This job is not running in a GitHub Actions Hosted Runner Ubuntu VM. Harden Runner is only supported on Ubuntu VM. This job will not be monitored.";
27755-
const SELF_HOSTED_NO_AGENT_MESSAGE = "This job is running on a self-hosted runner, but the runner does not have Harden-Runner installed. This job will not be monitored.";
27755+
const SELF_HOSTED_RUNNER_MESSAGE = "This job is running on a self-hosted runner.";
2775627756
const HARDEN_RUNNER_UNAVAILABLE_MESSAGE = "Sorry, we are currently experiencing issues with the Harden Runner installation process. It is currently unavailable.";
2775727757
const ARC_RUNNER_MESSAGE = "Workflow is currently being executed in ARC based runner.";
2775827758
const ARM64_RUNNER_MESSAGE = "ARM runners are not supported in the Harden-Runner community tier.";

‎dist/index.js.map

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎dist/post/index.js

Lines changed: 16 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -27751,7 +27751,7 @@ function addSummary() {
2775127751
const STATUS_HARDEN_RUNNER_UNAVAILABLE = "409";
2775227752
const CONTAINER_MESSAGE = "This job is running in a container. Harden Runner does not run in a container as it needs sudo access to run. This job will not be monitored.";
2775327753
const UBUNTU_MESSAGE = "This job is not running in a GitHub Actions Hosted Runner Ubuntu VM. Harden Runner is only supported on Ubuntu VM. This job will not be monitored.";
27754-
const SELF_HOSTED_NO_AGENT_MESSAGE = "This job is running on a self-hosted runner, but the runner does not have Harden-Runner installed. This job will not be monitored.";
27754+
const SELF_HOSTED_RUNNER_MESSAGE = "This job is running on a self-hosted runner.";
2775527755
const HARDEN_RUNNER_UNAVAILABLE_MESSAGE = "Sorry, we are currently experiencing issues with the Harden Runner installation process. It is currently unavailable.";
2775627756
const ARC_RUNNER_MESSAGE = "Workflow is currently being executed in ARC based runner.";
2775727757
const ARM64_RUNNER_MESSAGE = "ARM runners are not supported in the Harden-Runner community tier.";
@@ -27792,7 +27792,7 @@ function isDocker() {
2779227792
;// CONCATENATED MODULE: ./src/arc-runner.ts
2779327793

2779427794

27795-
function isArcRunner() {
27795+
function isARCRunner() {
2779627796
const runnerUserAgent = process.env["GITHUB_ACTIONS_RUNNER_EXTRA_USER_AGENT"];
2779727797
let isARC = false;
2779827798
if (!runnerUserAgent) {
@@ -27805,20 +27805,27 @@ function isArcRunner() {
2780527805
}
2780627806
function isSecondaryPod() {
2780727807
const workDir = "/__w";
27808-
return external_fs_.existsSync(workDir);
27808+
let hasKubeEnv = process.env["KUBERNETES_PORT"] !== undefined;
27809+
return external_fs_.existsSync(workDir) && hasKubeEnv;
2780927810
}
2781027811
function sendAllowedEndpoints(endpoints) {
27812+
const startTime = Date.now();
2781127813
const allowedEndpoints = endpoints.split(" "); // endpoints are space separated
27812-
for (const endpoint of allowedEndpoints) {
27813-
if (endpoint) {
27814+
let sent = 0;
27815+
for (let endpoint of allowedEndpoints) {
27816+
endpoint = endpoint.trim();
27817+
if (endpoint.length > 0) {
2781427818
let encodedEndpoint = Buffer.from(endpoint).toString("base64");
2781527819
let endpointPolicyStr = `step_policy_endpoint_${encodedEndpoint}`;
2781627820
echo(endpointPolicyStr);
27821+
sent++;
2781727822
}
2781827823
}
27819-
if (allowedEndpoints.length > 0) {
27820-
applyPolicy(allowedEndpoints.length);
27824+
if (sent > 0) {
27825+
applyPolicy(sent);
2782127826
}
27827+
const duration = Date.now() - startTime;
27828+
console.log(`[harden-runner] sendAllowedEndpoints completed in ${duration}ms (sent ${sent} endpoints)`);
2782227829
}
2782327830
function applyPolicy(count) {
2782427831
let applyPolicyStr = `step_policy_apply_${count}`;
@@ -27897,7 +27904,7 @@ var cleanup_awaiter = (undefined && undefined.__awaiter) || function (thisArg, _
2789727904
console.log(CONTAINER_MESSAGE);
2789827905
return;
2789927906
}
27900-
if (isArcRunner()) {
27907+
if (isARCRunner()) {
2790127908
console.log(`[!] ${ARC_RUNNER_MESSAGE}`);
2790227909
return;
2790327910
}
@@ -27952,7 +27959,7 @@ var cleanup_awaiter = (undefined && undefined.__awaiter) || function (thisArg, _
2795227959
try {
2795327960
var journalLog = external_child_process_.execSync("sudo journalctl -u agent.service --lines=1000", {
2795427961
encoding: "utf8",
27955-
maxBuffer: 1024 * 1024 * 10 // 10MB buffer
27962+
maxBuffer: 1024 * 1024 * 10, // 10MB buffer
2795627963
});
2795727964
console.log("agent.service log:");
2795827965
console.log(journalLog);

‎dist/post/index.js.map

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎dist/pre/index.js

Lines changed: 18 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -87779,7 +87779,7 @@ function addSummary() {
8777987779
const STATUS_HARDEN_RUNNER_UNAVAILABLE = "409";
8778087780
const CONTAINER_MESSAGE = "This job is running in a container. Harden Runner does not run in a container as it needs sudo access to run. This job will not be monitored.";
8778187781
const UBUNTU_MESSAGE = "This job is not running in a GitHub Actions Hosted Runner Ubuntu VM. Harden Runner is only supported on Ubuntu VM. This job will not be monitored.";
87782-
const SELF_HOSTED_NO_AGENT_MESSAGE = "This job is running on a self-hosted runner, but the runner does not have Harden-Runner installed. This job will not be monitored.";
87782+
const SELF_HOSTED_RUNNER_MESSAGE = "This job is running on a self-hosted runner.";
8778387783
const HARDEN_RUNNER_UNAVAILABLE_MESSAGE = "Sorry, we are currently experiencing issues with the Harden Runner installation process. It is currently unavailable.";
8778487784
const ARC_RUNNER_MESSAGE = "Workflow is currently being executed in ARC based runner.";
8778587785
const ARM64_RUNNER_MESSAGE = "ARM runners are not supported in the Harden-Runner community tier.";
@@ -87920,7 +87920,7 @@ var cacheUtils = __nccwpck_require__(1518);
8792087920
;// CONCATENATED MODULE: ./src/arc-runner.ts
8792187921

8792287922

87923-
function isArcRunner() {
87923+
function isARCRunner() {
8792487924
const runnerUserAgent = process.env["GITHUB_ACTIONS_RUNNER_EXTRA_USER_AGENT"];
8792587925
let isARC = false;
8792687926
if (!runnerUserAgent) {
@@ -87933,20 +87933,27 @@ function isArcRunner() {
8793387933
}
8793487934
function isSecondaryPod() {
8793587935
const workDir = "/__w";
87936-
return external_fs_.existsSync(workDir);
87936+
let hasKubeEnv = process.env["KUBERNETES_PORT"] !== undefined;
87937+
return external_fs_.existsSync(workDir) && hasKubeEnv;
8793787938
}
8793887939
function sendAllowedEndpoints(endpoints) {
87940+
const startTime = Date.now();
8793987941
const allowedEndpoints = endpoints.split(" "); // endpoints are space separated
87940-
for (const endpoint of allowedEndpoints) {
87941-
if (endpoint) {
87942+
let sent = 0;
87943+
for (let endpoint of allowedEndpoints) {
87944+
endpoint = endpoint.trim();
87945+
if (endpoint.length > 0) {
8794287946
let encodedEndpoint = Buffer.from(endpoint).toString("base64");
8794387947
let endpointPolicyStr = `step_policy_endpoint_${encodedEndpoint}`;
8794487948
echo(endpointPolicyStr);
87949+
sent++;
8794587950
}
8794687951
}
87947-
if (allowedEndpoints.length > 0) {
87948-
applyPolicy(allowedEndpoints.length);
87952+
if (sent > 0) {
87953+
applyPolicy(sent);
8794987954
}
87955+
const duration = Date.now() - startTime;
87956+
console.log(`[harden-runner] sendAllowedEndpoints completed in ${duration}ms (sent ${sent} endpoints)`);
8795087957
}
8795187958
function applyPolicy(count) {
8795287959
let applyPolicyStr = `step_policy_apply_${count}`;
@@ -88242,7 +88249,7 @@ var setup_awaiter = (undefined && undefined.__awaiter) || function (thisArg, _ar
8824288249
if (!confg.disable_telemetry || confg.egress_policy === "audit") {
8824388250
printInfo(web_url);
8824488251
}
88245-
if (isArcRunner()) {
88252+
if (isARCRunner()) {
8824688253
console.log(`[!] ${ARC_RUNNER_MESSAGE}`);
8824788254
if (confg.egress_policy === "block") {
8824888255
sendAllowedEndpoints(confg.allowed_endpoints);
@@ -88256,22 +88263,10 @@ var setup_awaiter = (undefined && undefined.__awaiter) || function (thisArg, _ar
8825688263
external_fs_.appendFileSync(process.env.GITHUB_STATE, `selfHosted=true${external_os_.EOL}`, {
8825788264
encoding: "utf8",
8825888265
});
88259-
if (!external_fs_.existsSync("/home/agent/agent")) {
88260-
lib_core.info(SELF_HOSTED_NO_AGENT_MESSAGE);
88261-
return;
88262-
}
88266+
lib_core.info(SELF_HOSTED_RUNNER_MESSAGE);
8826388267
if (confg.egress_policy === "block") {
88264-
try {
88265-
if (process.env.USER) {
88266-
chownForFolder(process.env.USER, "/home/agent");
88267-
}
88268-
const confgStr = JSON.stringify(confg);
88269-
external_fs_.writeFileSync("/home/agent/block_event.json", confgStr);
88270-
yield setup_sleep(5000);
88271-
}
88272-
catch (error) {
88273-
lib_core.info(`[!] Unable to write block_event.json: ${error}`);
88274-
}
88268+
sendAllowedEndpoints(confg.allowed_endpoints);
88269+
yield setup_sleep(5000);
8827588270
}
8827688271
return;
8827788272
}

‎dist/pre/index.js.map

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎src/arc-runner.ts

Lines changed: 16 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ import * as cp from "child_process";
22
import * as fs from "fs";
33
import path from "path";
44

5-
export function isArcRunner(): boolean {
5+
export function isARCRunner(): boolean {
66
const runnerUserAgent = process.env["GITHUB_ACTIONS_RUNNER_EXTRA_USER_AGENT"];
77

88
let isARC = false;
@@ -18,23 +18,33 @@ export function isArcRunner(): boolean {
1818

1919
function isSecondaryPod(): boolean {
2020
const workDir = "/__w";
21-
return fs.existsSync(workDir);
21+
let hasKubeEnv = process.env["KUBERNETES_PORT"] !== undefined;
22+
return fs.existsSync(workDir) && hasKubeEnv;
2223
}
2324

2425
export function sendAllowedEndpoints(endpoints: string): void {
26+
const startTime = Date.now();
2527
const allowedEndpoints = endpoints.split(" "); // endpoints are space separated
2628

27-
for (const endpoint of allowedEndpoints) {
28-
if (endpoint) {
29+
let sent = 0;
30+
for (let endpoint of allowedEndpoints) {
31+
endpoint = endpoint.trim();
32+
if (endpoint.length > 0) {
2933
let encodedEndpoint = Buffer.from(endpoint).toString("base64");
3034
let endpointPolicyStr = `step_policy_endpoint_${encodedEndpoint}`;
3135
echo(endpointPolicyStr);
36+
sent++;
3237
}
3338
}
3439

35-
if (allowedEndpoints.length > 0) {
36-
applyPolicy(allowedEndpoints.length);
40+
if (sent > 0) {
41+
applyPolicy(sent);
3742
}
43+
44+
const duration = Date.now() - startTime;
45+
console.log(
46+
`[harden-runner] sendAllowedEndpoints completed in ${duration}ms (sent ${sent} endpoints)`
47+
);
3848
}
3949

4050
function applyPolicy(count: number): void {

‎src/cleanup.ts

Lines changed: 10 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ import * as fs from "fs";
22
import * as cp from "child_process";
33
import * as common from "./common";
44
import isDocker from "is-docker";
5-
import { isArcRunner } from "./arc-runner";
5+
import { isARCRunner } from "./arc-runner";
66
import { isGithubHosted } from "./tls-inspect";
77
(async () => {
88
console.log("[harden-runner] post-step");
@@ -16,7 +16,7 @@ import { isGithubHosted } from "./tls-inspect";
1616
return;
1717
}
1818

19-
if (isArcRunner()) {
19+
if (isARCRunner()) {
2020
console.log(`[!] ${common.ARC_RUNNER_MESSAGE}`);
2121
return;
2222
}
@@ -82,13 +82,16 @@ import { isGithubHosted } from "./tls-inspect";
8282

8383
var disable_sudo = process.env.STATE_disableSudo;
8484
var disable_sudo_and_containers = process.env.STATE_disableSudoAndContainers;
85-
85+
8686
if (disable_sudo !== "true" && disable_sudo_and_containers !== "true") {
8787
try {
88-
var journalLog = cp.execSync("sudo journalctl -u agent.service --lines=1000", {
89-
encoding: "utf8",
90-
maxBuffer: 1024 * 1024 * 10 // 10MB buffer
91-
});
88+
var journalLog = cp.execSync(
89+
"sudo journalctl -u agent.service --lines=1000",
90+
{
91+
encoding: "utf8",
92+
maxBuffer: 1024 * 1024 * 10, // 10MB buffer
93+
}
94+
);
9295
console.log("agent.service log:");
9396
console.log(journalLog);
9497
} catch (error) {

‎src/common.ts

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -173,8 +173,8 @@ export const CONTAINER_MESSAGE =
173173
export const UBUNTU_MESSAGE =
174174
"This job is not running in a GitHub Actions Hosted Runner Ubuntu VM. Harden Runner is only supported on Ubuntu VM. This job will not be monitored.";
175175

176-
export const SELF_HOSTED_NO_AGENT_MESSAGE =
177-
"This job is running on a self-hosted runner, but the runner does not have Harden-Runner installed. This job will not be monitored.";
176+
export const SELF_HOSTED_RUNNER_MESSAGE =
177+
"This job is running on a self-hosted runner.";
178178

179179
export const HARDEN_RUNNER_UNAVAILABLE_MESSAGE =
180180
"Sorry, we are currently experiencing issues with the Harden Runner installation process. It is currently unavailable.";

‎src/setup.ts

Lines changed: 10 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ import { GetCacheEntryDownloadURLRequest } from "@actions/cache/lib/generated/re
2424
import { getCacheServiceVersion } from "@actions/cache/lib/internal/config";
2525

2626
import * as utils from "@actions/cache/lib/internal/cacheUtils";
27-
import { isArcRunner, sendAllowedEndpoints } from "./arc-runner";
27+
import { isARCRunner, sendAllowedEndpoints } from "./arc-runner";
2828
import { STEPSECURITY_API_URL, STEPSECURITY_WEB_URL } from "./configs";
2929
import { isGithubHosted, isTLSEnabled } from "./tls-inspect";
3030
import { installAgent } from "./install-agent";
@@ -62,7 +62,9 @@ interface MonitorResponse {
6262
egress_policy: core.getInput("egress-policy"),
6363
disable_telemetry: core.getBooleanInput("disable-telemetry"),
6464
disable_sudo: core.getBooleanInput("disable-sudo"),
65-
disable_sudo_and_containers: core.getBooleanInput("disable-sudo-and-containers"),
65+
disable_sudo_and_containers: core.getBooleanInput(
66+
"disable-sudo-and-containers"
67+
),
6668
disable_file_monitoring: core.getBooleanInput("disable-file-monitoring"),
6769
private: context?.payload?.repository?.private || false,
6870
is_github_hosted: isGithubHosted(),
@@ -205,7 +207,7 @@ interface MonitorResponse {
205207
common.printInfo(web_url);
206208
}
207209

208-
if (isArcRunner()) {
210+
if (isARCRunner()) {
209211
console.log(`[!] ${common.ARC_RUNNER_MESSAGE}`);
210212
if (confg.egress_policy === "block") {
211213
sendAllowedEndpoints(confg.allowed_endpoints);
@@ -220,22 +222,12 @@ interface MonitorResponse {
220222
fs.appendFileSync(process.env.GITHUB_STATE, `selfHosted=true${EOL}`, {
221223
encoding: "utf8",
222224
});
223-
if (!fs.existsSync("/home/agent/agent")) {
224-
core.info(common.SELF_HOSTED_NO_AGENT_MESSAGE);
225-
return;
226-
}
227-
if (confg.egress_policy === "block") {
228-
try {
229-
if (process.env.USER) {
230-
chownForFolder(process.env.USER, "/home/agent");
231-
}
232225

233-
const confgStr = JSON.stringify(confg);
234-
fs.writeFileSync("/home/agent/block_event.json", confgStr);
235-
await sleep(5000);
236-
} catch (error) {
237-
core.info(`[!] Unable to write block_event.json: ${error}`);
238-
}
226+
core.info(common.SELF_HOSTED_RUNNER_MESSAGE);
227+
228+
if (confg.egress_policy === "block") {
229+
sendAllowedEndpoints(confg.allowed_endpoints);
230+
await sleep(5000);
239231
}
240232
return;
241233
}

0 commit comments

Comments
 (0)