Skip to content

Commit aa817ef

Browse files
authoredJul 18, 2023
Update README (#321)
1 parent 75ac554 commit aa817ef

6 files changed

+37
-66
lines changed
 

‎README.md

+37-66
Original file line numberDiff line numberDiff line change
@@ -13,30 +13,29 @@
1313

1414
</div>
1515

16-
---
16+
## GitHub Actions Runtime Security
1717

18-
🔒 Harden-Runner GitHub Action installs a security agent on the GitHub-hosted runner (Ubuntu VM) to
18+
Harden-Runner GitHub Action provides Runtime Security for GitHub-Hosted runners and self-hosted Actions Runner Controller (ARC) environments.
1919

20-
1. Prevent exfiltration of credentials 🔑
21-
2. Detect tampering of source code during build 🕵️
22-
3. Detect compromised dependencies and build tools 🚨
20+
[![Harden Runner Demo](images/RuntimeSecurityDemo.gif)](https://youtu.be/fpdwX5hYACo)
2321

22+
## Explore open source projects using Harden-Runner
2423

25-
<p align="center">
26-
<img src="images/demo.gif" alt="Harden Runner demo">
27-
</p>
24+
| [![Microsoft](https://avatars.githubusercontent.com/u/6154722?s=60&v=4)](https://app.stepsecurity.io/github/microsoft/ebpf-for-windows/actions/runs/5559160177) | [![Google](https://avatars.githubusercontent.com/u/2810941?s=60&v=4)](https://app.stepsecurity.io/github/GoogleCloudPlatform/functions-framework-ruby/actions/runs/5546354505) | [![DataDog](https://avatars.githubusercontent.com/u/365230?s=60&v=4)](https://app.stepsecurity.io/github/DataDog/stratus-red-team/actions/runs/5387101451) | [![Intel](https://avatars.githubusercontent.com/u/17888862?s=60&v=4)](https://app.stepsecurity.io/github/intel/cve-bin-tool/actions/runs/5579910614) | [![Kubernetes](https://avatars.githubusercontent.com/u/36015203?s=60&v=4)](https://app.stepsecurity.io/github/kubernetes-sigs/cluster-api-provider-azure/actions/runs/5581511101) | [![Node.js](https://avatars.githubusercontent.com/u/9950313?s=60&v=4)](https://app.stepsecurity.io/github/nodejs/node/actions/runs/5563468674) | [![OPA](https://avatars.githubusercontent.com/u/16468693?s=60&v=4)](https://app.stepsecurity.io/github/open-policy-agent/gatekeeper/actions/runs/5578825701) | [![Mastercard](https://avatars.githubusercontent.com/u/1653148?s=60&v=4)](https://app.stepsecurity.io/github/Mastercard/flow/actions/runs/5542112873) |
25+
| --- | --- | --- | --- | --- | -- | -- | -- |
26+
| **Microsoft**<br>[Explore](https://app.stepsecurity.io/github/microsoft/ebpf-for-windows/actions/runs/5559160177) | **Google**<br>[Explore](https://app.stepsecurity.io/github/GoogleCloudPlatform/functions-framework-ruby/actions/runs/5546354505) | **DataDog**<br>[Explore](https://app.stepsecurity.io/github/DataDog/stratus-red-team/actions/runs/5387101451) | **Intel**<br>[Explore](https://app.stepsecurity.io/github/intel/cve-bin-tool/actions/runs/5579910614) | **Kubernetes**<br>[Explore](https://app.stepsecurity.io/github/kubernetes-sigs/cluster-api-provider-azure/actions/runs/5581511101) | **Node.js**<br>[Explore](https://app.stepsecurity.io/github/nodejs/node/actions/runs/5563468674) | **OpenPolicyAgent**<br>[Explore](https://app.stepsecurity.io/github/open-policy-agent/gatekeeper/actions/runs/5578825701) | **Mastercard**<br>[Explore](https://app.stepsecurity.io/github/Mastercard/flow/actions/runs/5542112873) |
2827

2928
## Why
3029

31-
Compromised dependencies and build tools typically make outbound calls to exfiltrate credentials, or may tamper source code, dependencies, or artifacts during the build.
30+
Compromised workflows, dependencies, and build tools typically make outbound calls to exfiltrate credentials, or may tamper source code, dependencies, or artifacts during the build.
3231

33-
Harden-Runner GitHub Actions installs a daemon that monitors process, file, and network activity to:
32+
Harden-Runner GitHub Action monitors process, file, and network activity to:
3433

35-
| | Countermeasure | Threat |
34+
| | Countermeasure | Prevent Security Breach |
3635
| --- | -------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
37-
| 1. | Block outbound calls that are not in the allowed list to prevent exfiltration of credentials | To prevent [Codecov breach](https://github.com/step-security/attack-simulator/blob/main/docs/RestrictOutboundTraffic.md) scenario |
38-
| 2. | Detect if source code is being overwritten during the build process to inject a backdoor | To detect [SolarWinds incident scenario](https://github.com/step-security/attack-simulator/blob/main/docs/MonitorSourceCode.md) |
39-
| 3. | Detect compromised dependencies that make unexpected outbound network calls | To detect [Dependency confusion](https://github.com/step-security/attack-simulator/blob/main/docs/DNSExfiltration.md) and [Malicious dependencies](https://github.com/step-security/attack-simulator/blob/main/docs/CompromisedDependency.md) |
36+
| 1. | Block egress traffic at the DNS (Layer 7) and network layers (Layers 3 and 4) to prevent exfiltration of credentials | To prevent [Codecov breach](https://github.com/step-security/github-actions-goat/blob/main/docs/Vulnerabilities/ExfiltratingCICDSecrets.md) scenario |
37+
| 2. | Detect if source code is being overwritten during the build process to inject a backdoor | To detect [SolarWinds incident](https://github.com/step-security/github-actions-goat/blob/main/docs/Vulnerabilities/TamperingDuringBuild.md) scenario |
38+
| 3. | Detect poisoned workflows and compromised dependencies | To detect [Dependency confusion](https://github.com/step-security/github-actions-goat/blob/main/docs/Vulnerabilities/ExfiltratingCICDSecrets.md#dependency-confusion-attacks) and [Malicious dependencies](https://github.com/step-security/github-actions-goat/blob/main/docs/Vulnerabilities/ExfiltratingCICDSecrets.md#compromised-dependencies) |
4039

4140
Read this [case study](https://infosecwriteups.com/detecting-malware-packages-in-github-actions-7b93a9985635) on how Harden-Runner detected malicious packages in the NPM registry.
4241

@@ -51,40 +50,48 @@ Read this [case study](https://infosecwriteups.com/detecting-malware-packages-in
5150
egress-policy: audit
5251
```
5352
54-
2. In the workflow logs, you will see a link to security insights and recommendations.
53+
2. In the workflow logs and the job markdown summary, you will see a link to security insights and recommendations.
5554
5655
<p align="left">
5756
<img src="images/buildlog1.png" alt="Link in build log" >
5857
</p>
5958
60-
3. Click on the link ([example link](https://app.stepsecurity.io/github/ossf/scorecard/actions/runs/2265028928)). You will see a process monitor view of file and network activities correlated with each step of the job. These insights hold significant value for forensic investigations, proving crucial in the event of an incident.
59+
3. Click on the link ([example link](https://app.stepsecurity.io/github/microsoft/msquic/actions/runs/5577342236)). You will see a process monitor view of network and file events correlated with each step of the job.
6160
6261
<p align="left">
63-
<img src="images/insights2.png" alt="Insights from harden-runner" >
62+
<img src="images/Insights4.png" alt="Insights from harden-runner" >
6463
</p>
6564
66-
4. Under the insights section, you'll find a suggested policy. You can either update your workflow file with this policy, or alternatively, use the [Policy Store](https://docs.stepsecurity.io/harden-runner/how-tos/block-egress-traffic#2-add-the-policy-using-the-policy-store) to apply the policy without modifying the workflow file.
65+
4. Under the insights section, you'll find a Recommended Policy. You can either update your workflow file with this Policy, or alternatively, use the [Policy Store](https://docs.stepsecurity.io/harden-runner/how-tos/block-egress-traffic#2-add-the-policy-using-the-policy-store) to apply the policy without modifying the workflow file.
6766
6867
<p align="left">
6968
<img src="images/rec-policy1.png" alt="Policy recommended by harden-runner" >
7069
</p>
7170
71+
## Support for ARC and Private Repositories
72+
73+
Actions Runner Controller (ARC) and Private repositories are supported with a commercial license. Check out the [documentation](https://docs.stepsecurity.io/stepsecurity-platform/billing) for more details.
74+
75+
Install the [StepSecurity Actions Security GitHub App](https://github.com/apps/stepsecurity-actions-security) to use Harden-Runner GitHub Action for `Private` repositories.
76+
77+
- If you use Harden-Runner GitHub Action in a private repository, the generated insights URL is NOT public.
78+
- You need to authenticate first to access insights URL for private repository. Only those who have access to the repository can view it.
79+
- [StepSecurity Actions Security GitHub App](https://github.com/apps/stepsecurity-actions-security) only needs `actions: read` permissions on your repositories.
80+
81+
Read this [case study on how Kapiche uses Harden-Runner](https://www.stepsecurity.io/case-studies/kapiche/) to improve software supply chain security in their private repositories.
82+
7283
## Features at a glance
7384

7485
For details, check out the documentation at https://docs.stepsecurity.io
7586

76-
<p align="left">
77-
<img src="images/main-screenshot1.png" alt="Policy recommended by harden-runner">
78-
</p>
79-
8087
### 🚦 Restrict egress traffic to allowed endpoints
8188

8289
Once allowed endpoints are set in the policy in the workflow file, or in the [Policy Store](https://docs.stepsecurity.io/harden-runner/how-tos/block-egress-traffic#2-add-the-policy-using-the-policy-store)
8390

8491
- Harden-Runner blocks egress traffic at the DNS (Layer 7) and network layers (Layers 3 and 4).
8592
- It blocks DNS exfiltration, where attacker tries to send data out using DNS resolution
8693
- Blocks outbound traffic using IP tables
87-
- Wildcard domains are supported, e.g. you can add `*.data.mcr.microsoft.com:443` to the allowed list, and egress traffic will be allowed to `eastus.data.mcr.microsoft.com:443` and `westus.data.mcr.microsoft.com:443`.
94+
- Wildcard domains are supported, e.g. you can add `*.data.mcr.microsoft.com:443` to the allowed list, and egress traffic will be allowed to `eastus.data.mcr.microsoft.com:443` and `westus.data.mcr.microsoft.com:443`.
8895

8996
<p align="left">
9097
<img src="images/block-outbound-call.png" alt="Policy recommended by harden-runner" >
@@ -119,55 +126,19 @@ Install the [StepSecurity Actions Security GitHub App](https://github.com/apps/s
119126
- Notifications are sent when outbound traffic is blocked or source code is overwritten
120127
- Notifications are not repeated for the same alert for a given workflow
121128

122-
## Support for private repositories
123-
124-
Private repositories are supported if they have a commercial license. Check out the [documentation](https://docs.stepsecurity.io/harden-runner/installation/business-enterprise-license) for more details.
125-
126-
Install the [StepSecurity Actions Security GitHub App](https://github.com/apps/stepsecurity-actions-security) to use Harden-Runner GitHub Action for `Private` repositories.
127-
128-
- If you use Harden-Runner GitHub Action in a private repository, the generated insights URL is NOT public.
129-
- You need to authenticate first to access insights URL for private repository. Only those who have access to the repository can view it.
130-
- [StepSecurity Actions Security GitHub App](https://github.com/apps/stepsecurity-actions-security) only needs `actions: read` permissions on your repositories.
131-
132-
Read this [case study on how Kapiche uses Harden Runner](https://www.stepsecurity.io/case-studies/kapiche/) to improve software supply chain security in their open source and private repositories.
133-
134129
## Discussions
135130

136-
If you have questions or ideas, please use [discussions](https://github.com/step-security/harden-runner/discussions).
137-
138-
1. [Support for private repositories](https://github.com/step-security/harden-runner/discussions/74)
139-
2. [Where should allowed-endpoints be stored?](https://github.com/step-security/harden-runner/discussions/84)
140-
3. [Cryptographically verify tools run as part of the CI/ CD pipeline](https://github.com/step-security/harden-runner/discussions/94)
141-
142-
## Limitations
143-
144-
1. Harden-Runner GitHub Action only works for GitHub-hosted runners. Self-hosted runners are not supported. We have started work on supporting [Kubernetes-Based Self-Hosted Actions Runners](https://github.com/step-security/harden-runner/issues/104).
145-
2. Only Ubuntu VM is supported. Windows and MacOS GitHub-hosted runners are not supported. There is a discussion about that [here](https://github.com/step-security/harden-runner/discussions/121).
146-
3. Harden-Runner is not supported when [job is run in a container](https://docs.github.com/en/actions/using-jobs/running-jobs-in-a-container) as it needs sudo access on the Ubuntu VM to run. It can be used to monitor jobs that use containers to run steps. The limitation is if the entire job is run in a container. That is not common for GitHub Actions workflows, as most of them run directly on `ubuntu-latest`.
147-
148-
## Testimonials
149-
150-
> _I think this is a great idea and for the threat model of build-time, an immediate network egress request monitoring makes a lot of sense_ - [Liran Tal](https://stars.github.com/profiles/lirantal/), GitHub Star, and Author of Essential Node.js Security
151-
152-
> _Harden-Runner strikes an elegant balance between ease-of-use, maintainability, and mitigation that I intend to apply to all of my 300+ npm packages. I look forward to the tool’s improvement over time_ - [Jordan Harband](https://github.com/ljharb), Open Source Maintainer
153-
154-
> _Harden runner from Step security is such a nice solution, it is another piece of the puzzle in helping treat the CI environment like production and solving supply chain security. I look forward to seeing it evolve._ - Cam Parry, Staff Site Reliability Engineer, Kapiche
155-
156-
## Workflows using harden-runner
157-
158-
Some important workflows using harden-runner:
159-
| |Repository |Link to insights|
160-
|--|----------|----------------|
161-
|1.|[nvm-sh/nvm](https://github.com/nvm-sh/nvm/blob/master/.github/workflows/lint.yml)|[Link to insights](https://app.stepsecurity.io/github/nvm-sh/nvm/actions/runs/1757959262)|
162-
|2.|[jsx-eslint/eslint-plugin-react](https://github.com/jsx-eslint/eslint-plugin-react/blob/master/.github/workflows/release.yml)|[Link to insights](https://app.stepsecurity.io/github/yannickcr/eslint-plugin-react/actions/runs/1930818585)
163-
|3.|[microsoft/msquic](https://github.com/microsoft/msquic/blob/main/.github/workflows/docker-publish.yml)|[Link to insights](https://app.stepsecurity.io/github/microsoft/msquic/actions/runs/1759010243)
164-
|4.|[ossf/scorecard](https://github.com/ossf/scorecard/blob/main/.github/workflows/codeql-analysis.yml)|[Link to insights](https://app.stepsecurity.io/github/ossf/scorecard/actions/runs/2006162141)
165-
|5.|[Automattic/vip-go-mu-plugins](https://github.com/Automattic/vip-go-mu-plugins/blob/master/.github/workflows/e2e.yml)|[Link to insights](https://app.stepsecurity.io/github/Automattic/vip-go-mu-plugins/actions/runs/1758760957)
131+
If you have questions or ideas, please use [discussions](https://github.com/step-security/harden-runner/discussions). For support for ARC and Private repositories, email info@stepsecurity.io.
166132

167133
## How does it work?
168134

169-
Harden-Runner GitHub Action downloads and installs the StepSecurity Agent.
135+
For GitHub-hosted runners, Harden-Runner GitHub Action downloads and installs the StepSecurity Agent.
170136

171137
- The code to monitor file, process, and network activity is in the Agent.
172138
- The agent is written in Go and is open source at https://github.com/step-security/agent
173139
- The agent's build is reproducible. You can view the steps to reproduce the build [here](http://app.stepsecurity.io/github/step-security/agent/releases/latest)
140+
141+
## Limitations for GitHub-Hosted Runners
142+
143+
1. Only Ubuntu VM is supported. Windows and MacOS GitHub-hosted runners are not supported. There is a discussion about that [here](https://github.com/step-security/harden-runner/discussions/121).
144+
2. Harden-Runner is not supported when [job is run in a container](https://docs.github.com/en/actions/using-jobs/running-jobs-in-a-container) as it needs sudo access on the Ubuntu VM to run. It can be used to monitor jobs that use containers to run steps. The limitation is if the entire job is run in a container. That is not common for GitHub Actions workflows, as most of them run directly on `ubuntu-latest`.

‎images/Insights4.png

150 KB
Loading

‎images/RuntimeSecurityDemo.gif

3.91 MB
Loading

‎images/demo.gif

-1.09 MB
Binary file not shown.

‎images/insights2.png

-36.8 KB
Binary file not shown.

‎images/main-screenshot1.png

-456 KB
Binary file not shown.

0 commit comments

Comments
 (0)
Please sign in to comment.