search

godbus / dbus

Native Go bindings for D-Bus
BSD 2-Clause "Simplified" License
959 stars 222 forks source link

CI: Set minimal permissions on GitHub Workflow #357

Closed diogoteles08 closed 1 year ago

diogoteles08 commented 1 year ago

Hi!

I'm Diogo and I work on Google's Open Source Security Team(GOSST) in cooperation with the Open Source Security Foundation (OpenSSF). My core job is to suggest and implement security changes on widely used open source projects 😊

I'm here to suggest the definition of minimal permissions on your workflow, as it would harden your security agains supply-chain attacks. I see that you have only one workflow, the test.yml, but it does not specify the permissions for its jobs, letting their privileges determined by GitHub's defaults. By defining minimal permissions you would be secured against erroneous or malicious actions from external jobs you call from your workflow. It's specially important for the case they get compromised, for example.

Setting minimum permissions for workflows is recommended by GitHub itself and also by other security tools, such as Scorecards and StepSecurity.

I'd be happy to raise a PR with the changes if you agree.

guelfey commented 1 year ago

Thanks! Adressed in https://github.com/godbus/dbus/pull/360 - I guess that's the minimal set of permissions for a workflow that only really needs to check out the actual Git code.

diogoteles08 commented 1 year ago

Yep, that definitely addresses the issue. Thanks!