Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bypassing GitHub Actions policies in the dumbest way possible

blog.yossarian.net

Post reply on HN
Print view View original

111–120 of 129 posts

Re: Bypassing GitHub Actions policies in the dumbest way possible

#111

Post by kstrauser »

welshwelsh wrote: post #70
kj4ips wrote: post #6

This is a prime example of "If you make an unusable secure system, the users will turn it into an insecure usable one." If someone is actively subverting a control like this, it probably means that the control has morphed from a guardrail into a log across the tracks. Somewhat in the same vein as AppLocker &co. Almost everyone says you should be using it, but almost no-one does, because it takes a massive amount of e…

Nobody outside of the IT security bubble thinks that using AppLocker is a sensible idea. Companies have no business telling their employees which specific programs they can and cannot run to do their jobs, that's an absurd level of micromanagement.

> Companies have no business telling their employees which specific programs they can [run]

Agreed.

> and cannot run

I strongly disagree. I think those controls are great for denylists. For example, almost no one needs to run a BitTorrent client on their work laptops. (I said almost. If you’re one of them, make a case to your IT department.) Why allow it? Its presence vastly increases the odds of someone downloading porn (risk: sexual harassment) or warez (risks: malware, legal issues) with almost no upside to the company. I’m ok with a company denylisting those.

I couldn’t care less if you want to listen to Apple Music or Spotify while you work. Go for it. Even though it’s not strictly work-related, it makes happier employees with no significant downside. Want to use Zed instead of VSCode? Knock yourself out. I have no interest in maintaining an allowlist of vetted software. That’s awful for everyone involved. I absolutely don’t want anyone running even a dev version of anything Oracle in our non-Oracle shop, though, and tools to prevent that are welcome.

Re: Bypassing GitHub Actions policies in the dumbest way possible

#112

Post by woodruffw »

bluelightning2k wrote: post #86

I don't think this is a security flaw. That's like saying it's a security flaw in the Chrome store that you could enable dev mode, copy the malware and run it that way.

I think the closer analogy would be a org-managed Chrome policy preventing people from installing certain extensions, which could then be bypassed by sideloading those extensions.

Re: Bypassing GitHub Actions policies in the dumbest way possible

#113

Post by josefx »

kstrauser wrote: post #109
janstice wrote: post #96

Earlier quoted context omitted.

For example, if someone installs the wrong version of Oracle Java on a VM in our farm, the licencing cost is seven figures as they want to charge per core that it could conceivably run on - this would be career-limiting for a number of people at once.

Or VirtualBox’s extensions which make it usable. Those are free to download but could make you an audit target.

Is there still a reason to use VirtualBox?

Re: Bypassing GitHub Actions policies in the dumbest way possible

#114

Post by monster_truck »

saghm wrote: post #57
monster_truck wrote: post #19

Had these exact same thoughts while I was configuring a series of workflows and scripts to get around the multiple unjustified and longstanding restrictions on what things are allowed to happen when. That sinking feeling when you search for how to do something and all of the top results are issues that were opened over a decade ago... It is especially painful trying to use github to do anything useful at all after be…

It used 1.8 days of time to run for a single day? I'm less curious about who's paying for it than who's _using _ it on your repo, because I can't even imagine having an average of almost two people scanning a codebase every single minute of the day.

Have you looked at the default configuration? It runs any time there is a push to main.

Re: Bypassing GitHub Actions policies in the dumbest way possible

#115

Post by kstrauser »

josefx wrote: post #113
kstrauser wrote: post #109

Earlier quoted context omitted.

Or VirtualBox’s extensions which make it usable. Those are free to download but could make you an audit target.

Is there still a reason to use VirtualBox?

IMO, no. Maybe inertia from people who learned it long ago and stopped looking at the alternatives.

Re: Bypassing GitHub Actions policies in the dumbest way possible

#116

Post by throwaway290 »

1oooqooq wrote: post #107
hk1337 wrote: post #61

Earlier quoted context omitted.

I haven't tested this but the main risk that is possible is users creating PRs on public repositories with actions that run on pull request.

if your unprotect pr job can have side effects besides accessing the public repo and returning a boolean for passing status, what hope is there?

any job can have side effects so there is no hope indeed

Re: Bypassing GitHub Actions policies in the dumbest way possible

#117

Post by crabbone »

XCabbage wrote: post #106

I don't see the vulnerability. In fact, I think considering this a problem at all is ridiculous. Obviously it's impossible to block all ways of "bypassing" the policy. If you are a developer who has already been entrusted with the ability to make your GitHub Actions workflows run arbitrary code, then OF COURSE you can make it run the code of some published action, even if it's just by manual copy and paste. This fact…

Yes and no.

The problem of audit of third-party code is real. Especially because of the way GitHub allows embedding it in users' code: it's not centralized, doesn't require signatures / authentication.

But, I think, the real security-minded approach here should be at the container infrastructure level. I.e. security policies should apply to things like container network in the way similar to security groups in popular cloud providers, or executing particular system calls, or accessing filesystem paths.

Restrictions on the level of what actions can be mentioned in the "manifest" are just a bad approach that's not going to stop anyone.

Re: Bypassing GitHub Actions policies in the dumbest way possible

#118

Post by Arbortheus »

Already__Taken wrote: post #56
monster_truck wrote: post #19

Had these exact same thoughts while I was configuring a series of workflows and scripts to get around the multiple unjustified and longstanding restrictions on what things are allowed to happen when. That sinking feeling when you search for how to do something and all of the top results are issues that were opened over a decade ago... It is especially painful trying to use github to do anything useful at all after be…

I'm baffled you can't clone internal/private repos with anything other than a developer PAT. They have a UI to share access for workflows, let cloning use that...

Use a GitHub app, that’s what it’s for.

Re: Bypassing GitHub Actions policies in the dumbest way possible

#119

Post by protocolture »

samplatt wrote: post #99
protocolture wrote: post #90

Earlier quoted context omitted.

>Companies have no business telling their employees which specific programs they can and cannot run to do their jobs, that's an absurd level of micromanagement. Yet so many receptionists think that the application attached to the email sent by couriercompany@hotmail.com is a reasonable piece of software to run. Curious.

False dichotomy. The manager of the receptionist, or the head of their department, can decide what's appropriate for their job and dictate this to IT, and then they can lock it down. At my work currently IT have the first say and final say on all software, regardless of what it does or who is using it. It's an insane situation. Decisions are being made without any input from anyone even in the department of the users…

>At my work currently IT have the first say and final say on all software, regardless of what it does or who is using it.

Yeah but software isnt software.

Like I have a customer with users that just randomly started using VPN software to manage their client sites. VPN software that exposes the user machine directly to uncontrolled networks. This causes risks in both directions, because their clients run things like datacenters and power stations. Increases security risks for their business, and increases security risks for their customers, not to mention liability.

IT should be neutral. but IT done right, is guided by best practice. IT is ultimately responsible and accountable for security and function. You cant be responsible and accountable without control, or you exist just to be beaten up when shit goes sideways.

>the ones that actually make the company money...

Making the company money in an uncontrolled fashion is just extra distance to fall. If you ship a fantastic product with a massive supply chain induced vuln that destroys your clients there was no point in making that money in the first place.

Re: Bypassing GitHub Actions policies in the dumbest way possible

#120

Post by zmgsabst »

kstrauser wrote: post #110
zmgsabst wrote: post #98

Earlier quoted context omitted.

Developers are generally given specific environments to run code, which aren’t their laptops — eg, VMs in a development environment. The goal isn’t to stop a developer from doing something malicious, but to add a step to the chain for hackers to do something malicious: they need to pwn the developer laptop from the devbox before they can pivot to, eg, internal data systems.

In my experience, that’s rare. Everywhere I’ve worked had devs working on code directly on their laptops.

My experience is the opposite:

I haven’t worked somewhere we ran code locally in a long, long time. Your IDE is local, but the testing is remote — typically in an environment where you can match the runtime environment more closely (eg, ensuring the same dependencies, access to cloud resources, etc).

Post reply on HN