-
Notifications
You must be signed in to change notification settings - Fork 41
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Unexpected blockage of multicast socket #228
Comments
Thanks, @therealryan, for using harden runner and creating this issue. Let me investigate and get back to you. Thanks! |
@h0x0er please investigate this. Thanks! |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
The testing for my project involves running some toy services that use multicast UDP to discover each other.
This socket usage is not detected in audit mode (example report), but it is blocked when the suggested blocking egress-policy is put in place (PR, build). The build had to be cancelled when the relevant test hung, but the build logs shows:
I'm not at all sure whether multicast UDP presents an exfiltration risk in the context of a github action. Defaulting to blocking it is thus probably the correct position, but it'd be great if it showed up in the audit and could be added to the allowed operation set.
Cheers!
The text was updated successfully, but these errors were encountered: