Scrub runner auth before job pipeline

Author: jmcte

docker/runner-entrypoint.sh

@@ -10,6 +10,10 @@ runner_configured="false"
 runner_exit_code=0
 runner_exec_mode="runner"
 RUNNER_AUDIT_DEREGISTER_EVENT="runner_deregistered"
+github_pat_for_cleanup=""
+github_app_id_for_cleanup=""
+github_app_installation_id_for_cleanup=""
+github_app_private_key_for_cleanup=""
 
 run_runner_bash() {
   local command="$1"
@@ -81,7 +85,23 @@ prepare_runner_home() {
 }
 
 cleanup_runner() {
+  export GITHUB_PAT="${github_pat_for_cleanup}"
+  export GITHUB_APP_ID="${github_app_id_for_cleanup}"
+  export GITHUB_APP_INSTALLATION_ID="${github_app_installation_id_for_cleanup}"
+  export GITHUB_APP_PRIVATE_KEY="${github_app_private_key_for_cleanup}"
   cleanup_runner_registration "run_runner_bash \"cd '${RUNNER_HOME}' && ./config.sh remove --token \\\"\\\${RUNNER_REMOVE_TOKEN}\\\"\""
+  unset GITHUB_PAT GITHUB_APP_ID GITHUB_APP_INSTALLATION_ID GITHUB_APP_PRIVATE_KEY
+}
+
+stash_github_auth_for_cleanup() {
+  github_pat_for_cleanup="${GITHUB_PAT:-}"
+  github_app_id_for_cleanup="${GITHUB_APP_ID:-}"
+  github_app_installation_id_for_cleanup="${GITHUB_APP_INSTALLATION_ID:-}"
+  github_app_private_key_for_cleanup="${GITHUB_APP_PRIVATE_KEY:-}"
+}
+
+scrub_github_auth_env() {
+  unset GITHUB_PAT GITHUB_APP_ID GITHUB_APP_INSTALLATION_ID GITHUB_APP_PRIVATE_KEY
 }
 
 prepare_runtime_dirs() {
@@ -165,6 +185,7 @@ trap on_exit EXIT
 trap 'log "termination requested"; RUNNER_AUDIT_DEREGISTER_EVENT="runner_evicted"; export RUNNER_AUDIT_DEREGISTER_EVENT; exit 0' TERM INT
 
 require_github_auth
+stash_github_auth_for_cleanup
 require_env GITHUB_ORG
 require_env RUNNER_NAME
 require_env RUNNER_LABELS
@@ -279,5 +300,6 @@ runner_configured="true"
 audit_event runner_registered
 
 log "starting runner ${RUNNER_NAME}"
+scrub_github_auth_env
 run_runner_job_bash "cd '${RUNNER_HOME}' && exec ./run.sh" \
   2>&1 | tee -a "${RUNNER_LOG_DIR}/runner.log"

scripts/smoke-test.sh

@@ -182,6 +182,7 @@ run_smoke_case() {
   grep -q "config path: /tmp/runner-state/runner-home" "${state_dir}/config-context.log"
   grep -q "run path: /tmp/runner-state/runner-home" "${state_dir}/run-context.log"
   grep -q "github auth: unset" "${state_dir}/run-context.log"
+  grep -q "process github auth: unset" "${state_dir}/run-context.log"
   grep -q "runner writable home: /tmp/runner-state/runner-home" "${runner_stdout}"
   grep -q "^job output$" "${state_dir}/logs/runner.log"
   grep -q "run.sh stub executed" "${state_dir}/run.log"

scripts/smoke/actions-runner/run.sh

@@ -12,6 +12,16 @@ if [[ -n "${GITHUB_PAT:-}" \
   exit 1
 fi
 printf 'github auth: unset\n' >> "${RUNNER_STATE_DIR}/run-context.log"
+if [[ "$(id -u)" == "0" ]]; then
+  for environ in /proc/[0-9]*/environ; do
+    [[ -r "${environ}" ]] || continue
+    if tr '\0' '\n' < "${environ}" | grep -Eq '^(GITHUB_PAT|GITHUB_APP_ID|GITHUB_APP_INSTALLATION_ID|GITHUB_APP_PRIVATE_KEY)='; then
+      printf 'github auth visible in process env: %s\n' "${environ}" >> "${RUNNER_STATE_DIR}/run-context.log"
+      exit 1
+    fi
+  done
+fi
+printf 'process github auth: unset\n' >> "${RUNNER_STATE_DIR}/run-context.log"
 mkdir -p "${RUNNER_WORK_DIR}/workspace"
 touch "${RUNNER_WORK_DIR}/workspace/job.txt"
 echo "job output"