From b0d9561e1cf2d42065a53c6ce7138966a43394bd Mon Sep 17 00:00:00 2001 From: h0x0er Date: Wed, 16 Mar 2022 20:22:33 +0530 Subject: [PATCH 1/4] not adding api.snapcraft.io in annotation --- annotation.go | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/annotation.go b/annotation.go index 03a0e2b..ee3e4ed 100644 --- a/annotation.go +++ b/annotation.go @@ -3,6 +3,7 @@ package main import ( "fmt" "os" + "strings" "sync" ) @@ -12,6 +13,10 @@ func WriteAnnotation(message string) { annotationMutex.Lock() defer annotationMutex.Unlock() + if strings.Contains(message, "api.snapcraft.io") { + return + } + dir := "/home/agent" if _, err := os.Stat(dir); os.IsNotExist(err) { _ = os.Mkdir(dir, 0644) From d3eb0e685d99436a660fb750b56486a03f2f8e61 Mon Sep 17 00:00:00 2001 From: h0x0er Date: Wed, 16 Mar 2022 22:00:26 +0530 Subject: [PATCH 2/4] filtering in dnsproxy instead of write annotation --- annotation.go | 4 ---- dnsproxy.go | 8 +++++++- 2 files changed, 7 insertions(+), 5 deletions(-) diff --git a/annotation.go b/annotation.go index ee3e4ed..95bff22 100644 --- a/annotation.go +++ b/annotation.go @@ -13,10 +13,6 @@ func WriteAnnotation(message string) { annotationMutex.Lock() defer annotationMutex.Unlock() - if strings.Contains(message, "api.snapcraft.io") { - return - } - dir := "/home/agent" if _, err := os.Stat(dir); os.IsNotExist(err) { _ = os.Mkdir(dir, 0644) diff --git a/dnsproxy.go b/dnsproxy.go index ef19aa4..c8bf3c7 100644 --- a/dnsproxy.go +++ b/dnsproxy.go @@ -174,7 +174,13 @@ func (proxy *DNSProxy) getIPByDomain(domain string) (string, error) { if !proxy.isAllowedDomain(domain) { go WriteLog(fmt.Sprintf("domain not allowed: %s", domain)) - go WriteAnnotation(fmt.Sprintf("StepSecurity Harden Runner: DNS resolution for domain %s was blocked. This domain is not in the list of allowed-endpoints.", domain)) + + // call to api.snapcraft.io is made by snapd in GITHUB_RUNNER + // so if it's not present in allowed-domains, traffic to it will get blocked + // since it is called by default service, we don't need to add it to annotations + if !strings.Contains(domain, "api.snapcraft.io") { + go WriteAnnotation(fmt.Sprintf("StepSecurity Harden Runner: DNS resolution for domain %s was blocked. This domain is not in the list of allowed-endpoints.", domain)) + } // return an ip address, so calling process calls the ip address // the call will be blocked by the firewall From 0c903ae8bf100736e5f35f94493a91551e2c63f2 Mon Sep 17 00:00:00 2001 From: h0x0er Date: Wed, 16 Mar 2022 22:28:43 +0530 Subject: [PATCH 3/4] removed redudant package --- annotation.go | 1 - 1 file changed, 1 deletion(-) diff --git a/annotation.go b/annotation.go index 95bff22..03a0e2b 100644 --- a/annotation.go +++ b/annotation.go @@ -3,7 +3,6 @@ package main import ( "fmt" "os" - "strings" "sync" ) From 7b4446dd0c8aa91c780bf2272b41694cf09d196b Mon Sep 17 00:00:00 2001 From: Varun Sharma Date: Fri, 18 Mar 2022 09:34:42 -0700 Subject: [PATCH 4/4] Update firewall.go --- firewall.go | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/firewall.go b/firewall.go index 85c1af4..6033b65 100644 --- a/firewall.go +++ b/firewall.go @@ -227,10 +227,11 @@ func AddAuditRules(firewall *Firewall) error { ipt = firewall.IPTables } - // deny DNS on port 53 - // TODO: Deny UDP overall? - //err = ipt.Append("filter", "OUTPUT", "-o", "eth0", "-p", "udp", "--dport", "53", "-j", "DROP") - err = ipt.Append("filter", "OUTPUT", "-o", "eth0", "-p", "udp", "-j", "DROP") + // deny DNS on port 53, else it interferes with DNS proxy + // Do not Deny UDP overall as developers may be using it, e.g. MS QUIC + // https://github.com/step-security/harden-runner/issues/112 + err = ipt.Append("filter", "OUTPUT", "-o", "eth0", "-p", "udp", "--dport", "53", "-j", "DROP") + //err = ipt.Append("filter", "OUTPUT", "-o", "eth0", "-p", "udp", "-j", "DROP") if err != nil { return errors.Wrap(err, "failed to deny udp") } @@ -248,7 +249,7 @@ func AddAuditRules(firewall *Firewall) error { return fmt.Errorf(fmt.Sprintf("ClearChain failed for DOCKER-USER: %v", err)) } - err = ipt.Append("filter", "DOCKER-USER", "-i", "docker0", "-p", "udp", "-j", "DROP") + err = ipt.Append("filter", "DOCKER-USER", "-i", "docker0", "-p", "udp", "--dport", "53", "-j", "DROP") if err != nil { return fmt.Errorf(fmt.Sprintf("failed to deny udp docker interface: %v", err))