search

GitHubSecurityLab / actions-permissions

GitHub token permissions Monitor and Advisor actions
MIT License
244 stars 19 forks source link

Assumes runner can sudo to root? #26

Closed brianjmurrell closed 8 months ago

brianjmurrell commented 8 months ago

It would seem that this all requires that a workflow is able to sudo to root(!) on a runner, yes?

So if one was building ([more] secure) self-hosted runners without that capability for an action to gain root on one's runner, this action not work, yes?

Further, it assumes that a Linux runner is running on Ubuntu also.

JarLob commented 8 months ago

Yes, the monitor needs privileges to modify system files for traffic interception. The action supports the standard runners provided by GitHub, but you are welcome to create a pull request that adds support for other operating systems.