search

sourcegraph / sourcegraph-public-snapshot

Code AI platform with Code Search & Cody
https://sourcegraph.com
Other
10.1k stars 1.28k forks source link

executor: Verify checksum of resources before execution #15937

Open efritz opened 3 years ago

efritz commented 3 years ago

We run a src-cli binary and exec code inside docker images on Firecracker VM in the executor service. If a user escapes the container, they could pull new images or replace the src-cli binary on the host. If the replaced src-cli binary is invoked with a shared token back to the frontend (which we do to enable privileged LSIF uploads without a sudo access token), it could send the token elsewhere or make privileged requests to gitserver.

To mitigate this risk we should ensure that the docker images and binaries have the same checksum that we expect.

github-actions[bot] commented 3 years ago

Heads up @macraig - the "team/code-intelligence" label was applied to this issue.