130 lines
4.0 KiB
YAML
130 lines
4.0 KiB
YAML
name: Runner Isolation Check
|
|
on:
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
isolation-test:
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- name: Prepare environment
|
|
run: |
|
|
echo "=== INSTALLING TEST TOOLS ==="
|
|
apt-get update -y
|
|
DEBIAN_FRONTEND=noninteractive apt-get install -y \
|
|
curl iproute2 net-tools util-linux procps coreutils \
|
|
iputils-ping dnsutils libcap2-bin traceroute
|
|
|
|
- name: Basic system info
|
|
run: |
|
|
echo "=== SYSTEM INFO ==="
|
|
uname -a
|
|
id
|
|
cat /etc/os-release || true
|
|
echo "Running as user: $(whoami)"
|
|
pwd
|
|
df -h
|
|
|
|
- name: Dumping environment variables
|
|
run: |
|
|
echo "--- Check for parent variables ---"
|
|
printenv | grep -Pi 'GITEA_RUNNER_REGISTRATION_FILE|GITEA_RUNNER_REGISTRATION_TOKEN_FILE|GITEA_RUNNER_REGISTRATION_TOKEN' || true
|
|
echo "--- List all variables ---"
|
|
printenv
|
|
|
|
- name: Network routes and interfaces
|
|
run: |
|
|
echo "=== NETWORK ==="
|
|
ip addr
|
|
echo
|
|
ip route
|
|
echo
|
|
cat /etc/resolv.conf
|
|
|
|
- name: LAN reachability test
|
|
continue-on-error: true
|
|
run: |
|
|
set +e
|
|
echo "=== LAN REACHABILITY ==="
|
|
for subnet in 192.168.0.1 192.168.1.1 10.0.0.1 172.16.0.1 172.17.0.1 \
|
|
172.18.0.1 172.19.0.1 172.20.0.1 172.21.0.1 172.22.0.1 172.23.0.1 \
|
|
172.24.0.1 192.168.1.185; do
|
|
echo "--- Pinging $subnet:8098 ---"
|
|
ping -4 -n -c 4 $subnet || echo "no ping response"
|
|
echo "--- Contacting http://${subnet}:8098/docker-compose.yaml ---"
|
|
curl -s -m 5 http://$subnet:8098/docker-compose.yaml || echo "no http response"
|
|
done
|
|
echo "--- Checking private IP routes ---"
|
|
ip route | grep -E "192\.168|10\.|172\.(1[6-9]|2[0-9]|3[01])" \
|
|
&& echo "!! Possible LAN route detected !!" \
|
|
|| echo "No direct LAN route found."
|
|
|
|
- name: Check external IP
|
|
continue-on-error: true
|
|
run: |
|
|
set +e
|
|
echo "--- Checking external IP (https://ifconfig.me)"
|
|
curl -s https://ifconfig.me
|
|
true
|
|
|
|
- name: Host reachability sanity check
|
|
continue-on-error: true
|
|
run: |
|
|
set +e
|
|
echo "=== OUTBOUND TEST ==="
|
|
curl -fsSL https://google.com >/dev/null && echo "Internet access OK" || echo "No internet access?"
|
|
|
|
- name: Traceroute to google.com
|
|
continue-on-error: true
|
|
run: |
|
|
echo "=== Traceroute to google ==="
|
|
traceroute -4 -n google.com
|
|
|
|
- name: Process visibility
|
|
continue-on-error: true
|
|
run: |
|
|
set +e
|
|
echo "=== PROCESS VISIBILITY ==="
|
|
ps aux | head -20
|
|
ps aux | grep -E "dockerd|systemd|sshd|python" \
|
|
&& echo "!! Possible host process visible !!" \
|
|
|| echo "Looks isolated."
|
|
|
|
- name: Privilege and device access
|
|
continue-on-error: true
|
|
run: |
|
|
set +e
|
|
echo "=== PRIVILEGE CHECK ==="
|
|
id -Gn
|
|
ls -l /dev | head -30
|
|
mount | head -20
|
|
test -S /var/run/docker.sock \
|
|
&& echo "!! Host docker.sock mounted !!" \
|
|
|| echo "No docker.sock (good)"
|
|
|
|
- name: File system sanity check
|
|
continue-on-error: true
|
|
run: |
|
|
set +e
|
|
echo "=== FILESYSTEM ==="
|
|
ls -1 /
|
|
echo
|
|
test -f /root/.bashrc && echo "Root home accessible!" || echo "No /root home (good)"
|
|
head -n 3 /etc/passwd
|
|
|
|
- name: Capability check
|
|
continue-on-error: true
|
|
run: |
|
|
set +e
|
|
echo "=== CAPABILITIES ==="
|
|
capsh --print 2>/dev/null || echo "capsh not available"
|
|
dmesg 2>&1 | head -5 && echo "!! dmesg readable !!" || echo "dmesg not accessible (good)"
|
|
|
|
- name: Mount Info
|
|
continue-on-error: true
|
|
run: |
|
|
set +e
|
|
echo "=== Mount Info ==="
|
|
findmnt -a
|
|
|