Skip to content

GHA Runners create world-writable shared memory section #3739

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
billrobertson42 opened this issue Mar 10, 2025 · 0 comments
Open

GHA Runners create world-writable shared memory section #3739

billrobertson42 opened this issue Mar 10, 2025 · 0 comments
Labels
bug Something isn't working

Comments

@billrobertson42
Copy link

Describe the bug

Self-hosted gha runners on RHEL 9.4. They are creating a shared memory section with world-writable permissions. I assume that the runners use this to communicate among themselves. The issue is that the lttng-ust-wait-8 section has world-write permissions, and this is causing security audit concerns.

$ ll /dev/shm/

-rw-rw-rw- 1 gha-runner-7 gha-runner-7 4096 Feb 20 04:03 lttng-ust-wait-8
-rw-r----- 1 gha-runner-8 gha-runner-8 4096 Feb 20 04:03 lttng-ust-wait-8-558
-rw-r----- 1 gha-runner-7 gha-runner-7 4096 Feb 20 04:03 lttng-ust-wait-8-559
-rw-r----- 1 gha-runner-6 gha-runner-6 4096 Feb 20 04:03 lttng-ust-wait-8-560
-rw-r----- 1 gha-runner-5 gha-runner-5 4096 Feb 20 04:03 lttng-ust-wait-8-561
-rw-r----- 1 gha-runner-4 gha-runner-4 4096 Feb 20 04:03 lttng-ust-wait-8-562
-rw-r----- 1 gha-runner-3 gha-runner-3 4096 Feb 20 04:03 lttng-ust-wait-8-563
-rw-r----- 1 gha-runner-2 gha-runner-2 4096 Feb 20 04:03 lttng-ust-wait-8-564
-rw-r----- 1 gha-runner-1 gha-runner-1 4096 Feb 20 04:03 lttng-ust-wait-8-565

To Reproduce
Steps to reproduce the behavior:

  1. Setup multiple runners on same host, but running as different users
  2. Run them
  3. After running a job or three, check /dev/shm for files like the case above.

Expected behavior
A shared memory section should not have world-write permission.

Runner Version and Platform

Version of your runner?

OS of the machine running the runner? OSX/Windows/Linux/...
Linux RHEL 9.4

What's not working?

n/a

Job Log Output

n/a

Runner and Worker's Diagnostic Logs

n/a

@billrobertson42 billrobertson42 added the bug Something isn't working label Mar 10, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

1 participant