drift.yml: socket-privileged forgejo-smoke job is reachable from pull_request events #265

New issue

Closed

opened 2026-07-19 03:22:40 +00:00 by hexajon · 1 comment

hexajon commented

2026-07-19 03:22:40 +00:00

(Migrated from codeberg.org)

Security audit, highest-priority CI finding. The drift workflow triggers on pull_request (.forgejo/workflows/drift.yml:36), and its forgejo-smoke job - gated only by vars.RUN_FORGEJO_SMOKE == 'true' (drift.yml:99) - uses docker exec against the HOST docker socket to provision the sidecar Forgejo admin (drift.yml:167) and then executes PR-modifiable content (tests/integration/forgejo-smoke.sh, plus the run blocks themselves, drift.yml:183).

Consequence: on any runner where that variable is set and the docker socket is exposed, a malicious fork PR that edits the workflow or the smoke script gets code execution with host-docker-socket access, which is effectively host root. On Codeberg the vari

Security audit, highest-priority CI finding. The drift workflow triggers on `pull_request` (`.forgejo/workflows/drift.yml:36`), and its forgejo-smoke job - gated only by `vars.RUN_FORGEJO_SMOKE == 'true'` (drift.yml:99) - uses `docker exec` against the HOST docker socket to provision the sidecar Forgejo admin (drift.yml:167) and then executes PR-modifiable content (`tests/integration/forgejo-smoke.sh`, plus the run blocks themselves, drift.yml:183). Consequence: on any runner where that variable is set and the docker socket is exposed, a malicious fork PR that edits the workflow or the smoke script gets code execution with host-docker-socket access, which is effectively host root. On Codeberg the vari

hexajon commented

2026-07-19 03:42:59 +00:00

(Migrated from codeberg.org)

Duplicate of #266, which covers the same drift.yml pull_request + host-docker-socket pwn-request finding with the full two-option fix (confirm the org runner requires fork-PR approval, or drop pull_request from the socket-privileged smoke job) and severity labels. Consolidating there.

hexajon referenced this issue

2026-08-17 15:48:30 +00:00

Pre-launch: verify forge runner settings for fork PRs (approval gate, no docker socket, egress isolation) #415

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

sixfold-space/madtea#265

No description provided.

Rows
Columns