60 lines
2.2 KiB
YAML
60 lines
2.2 KiB
YAML
name: release-isolation-portfolio
|
|
'on':
|
|
push:
|
|
branches:
|
|
- ops/release-isolation-20261112
|
|
jobs:
|
|
baseline:
|
|
runs-on: diag-portfolio-runner
|
|
timeout-minutes: 5
|
|
steps:
|
|
- name: Provar isolamento efetivo
|
|
run: "node <<'JS'\nconst fs = require('node:fs');\nfor (const p of ['/var/run/docker.sock',\
|
|
\ '/run/docker.sock']) {\n if (fs.existsSync(p)) throw Error('Docker socket\
|
|
\ exposto: ' + p);\n}\nif (process.env.DOCKER_HOST) throw Error('DOCKER_HOST\
|
|
\ exposto');\nconst status = fs.readFileSync('/proc/self/status', 'utf8');\n\
|
|
const cap = BigInt('0x' + status.match(/^CapEff:\\s*([0-9a-f]+)/m)[1]);\n\
|
|
const forbidden = [16n, 17n, 19n, 21n].reduce((m,b) => m | (1n << b), 0n);\n\
|
|
if (cap & forbidden) throw Error('Capacidades privilegiadas expostas');\n\
|
|
console.log('ISOLATION_OK socket=absent privileged=false runner=' + process.env.RUNNER_NAME);\n\
|
|
JS\n"
|
|
privileged:
|
|
runs-on: diag-portfolio-runner
|
|
timeout-minutes: 5
|
|
container:
|
|
image: docker.gitea.com/runner-images:ubuntu-latest
|
|
options: --privileged
|
|
steps:
|
|
- name: Recusar elevação solicitada pelo workflow
|
|
run: 'node <<''JS''
|
|
|
|
const fs = require(''node:fs'');
|
|
|
|
if (fs.existsSync(''/var/run/docker.sock'')) throw Error(''Docker socket exposto'');
|
|
|
|
const s = fs.readFileSync(''/proc/self/status'', ''utf8'');
|
|
|
|
const cap = BigInt(''0x'' + s.match(/^CapEff:\s*([0-9a-f]+)/m)[1]);
|
|
|
|
const forbidden = [16n, 17n, 19n, 21n].reduce((m,b) => m | (1n << b), 0n);
|
|
|
|
if (cap & forbidden) throw Error(''Workflow conseguiu --privileged'');
|
|
|
|
console.log(''PRIVILEGED_DENIED runner='' + process.env.RUNNER_NAME);
|
|
|
|
JS
|
|
|
|
'
|
|
socket-bind:
|
|
runs-on: diag-portfolio-runner
|
|
timeout-minutes: 5
|
|
container:
|
|
image: docker.gitea.com/runner-images:ubuntu-latest
|
|
options: --volume=/var/run/docker.sock:/var/run/docker.sock
|
|
steps:
|
|
- name: Recusar bind solicitado pelo workflow
|
|
run: 'node -e "if(require(''node:fs'').existsSync(''/var/run/docker.sock''))throw
|
|
Error(''Socket bind permitido'');console.log(''SOCKET_BIND_DENIED'')"
|
|
|
|
'
|