Merge pull request #682 from rohan-stepsecurity/rp/feat/codebuild-self-v2

feat: avoid sudo when running as root

Author: varunsh-coder

dist/index.js

@@ -31910,14 +31910,28 @@ function getRunnerUser() {
         return undefined;
     }
 }
-function chownForFolder(newOwner, target) {
+function getPrivilegeMode() {
+    try {
+        if (os.userInfo().uid === 0) {
+            return "root";
+        }
+    }
+    catch (_a) {
+        // fall through to sudo
+    }
+    return "sudo";
+}
+function chownForFolder(newOwner, target, useDirectPrivileges = false) {
     if (!newOwner) {
         console.log(`Unable to determine runner user; skipping chown of ${target}`);
         return;
     }
-    let cmd = "sudo";
-    let args = ["chown", "-R", newOwner, target];
-    cp.execFileSync(cmd, args);
+    if (useDirectPrivileges) {
+        cp.execFileSync("chown", ["-R", newOwner, target]);
+    }
+    else {
+        cp.execFileSync("sudo", ["chown", "-R", newOwner, target]);
+    }
 }
 function isAgentInstalled(platform) {
     switch (platform) {

dist/index.js.map

@@ -31916,14 +31916,28 @@ function getRunnerUser() {
         return undefined;
     }
 }
-function chownForFolder(newOwner, target) {
+function getPrivilegeMode() {
+    try {
+        if (os.userInfo().uid === 0) {
+            return "root";
+        }
+    }
+    catch (_a) {
+        // fall through to sudo
+    }
+    return "sudo";
+}
+function chownForFolder(newOwner, target, useDirectPrivileges = false) {
     if (!newOwner) {
         console.log(`Unable to determine runner user; skipping chown of ${target}`);
         return;
     }
-    let cmd = "sudo";
-    let args = ["chown", "-R", newOwner, target];
-    cp.execFileSync(cmd, args);
+    if (useDirectPrivileges) {
+        cp.execFileSync("chown", ["-R", newOwner, target]);
+    }
+    else {
+        cp.execFileSync("sudo", ["chown", "-R", newOwner, target]);
+    }
 }
 function isAgentInstalled(platform) {
     switch (platform) {

dist/post/index.js

@@ -85108,14 +85108,28 @@ function getRunnerUser() {
         return undefined;
     }
 }
-function chownForFolder(newOwner, target) {
+function getPrivilegeMode() {
+    try {
+        if (external_os_.userInfo().uid === 0) {
+            return "root";
+        }
+    }
+    catch (_a) {
+        // fall through to sudo
+    }
+    return "sudo";
+}
+function chownForFolder(newOwner, target, useDirectPrivileges = false) {
     if (!newOwner) {
         console.log(`Unable to determine runner user; skipping chown of ${target}`);
         return;
     }
-    let cmd = "sudo";
-    let args = ["chown", "-R", newOwner, target];
-    external_child_process_.execFileSync(cmd, args);
+    if (useDirectPrivileges) {
+        external_child_process_.execFileSync("chown", ["-R", newOwner, target]);
+    }
+    else {
+        external_child_process_.execFileSync("sudo", ["chown", "-R", newOwner, target]);
+    }
 }
 function isAgentInstalled(platform) {
     switch (platform) {
@@ -85678,8 +85692,8 @@ function installAgent(isTLS, configStr) {
         return true;
     });
 }
-function installAgentBravo(configStr) {
-    return install_agent_awaiter(this, void 0, void 0, function* () {
+function installAgentBravo(configStr_1) {
+    return install_agent_awaiter(this, arguments, void 0, function* (configStr, useDirectPrivileges = false) {
         // Note: to avoid github rate limiting
         const token = lib_core.getInput("token", { required: true });
         const auth = `token ${token}`;
@@ -85693,11 +85707,14 @@ function installAgentBravo(configStr) {
         external_child_process_.execSync("chmod +x /home/agent/agent");
         external_fs_.writeFileSync("/home/agent/agent.json", configStr);
         const logStream = external_fs_.openSync("/home/agent/agent.stdout", "a");
-        const agentProcess = external_child_process_.spawn("sudo", ["/home/agent/agent"], {
+        const spawnOptions = {
             cwd: "/home/agent",
             detached: true,
             stdio: ["ignore", logStream, logStream],
-        });
+        };
+        const agentProcess = useDirectPrivileges
+            ? external_child_process_.spawn("/home/agent/agent", [], spawnOptions)
+            : external_child_process_.spawn("sudo", ["/home/agent/agent"], spawnOptions);
         agentProcess.unref();
         const agentStatus = "/home/agent/agent.status";
         const deadline = Date.now() + 10000;
@@ -86140,7 +86157,7 @@ process.on("unhandledRejection", (reason) => {
                         return;
                     }
                     case "linux":
-                        yield installAgentForBravo(github.context.repo.owner, bravoConfigStr);
+                        yield installAgentForBravo(github.context.repo.owner, bravoConfigStr, thirdPartyProvider);
                         return;
                 }
             }
@@ -86384,7 +86401,7 @@ function installAgentForSelfHosted(owner, confg) {
         }
     });
 }
-function installAgentForBravo(owner, bravoConfigStr) {
+function installAgentForBravo(owner, bravoConfigStr, provider) {
     return setup_awaiter(this, void 0, void 0, function* () {
         try {
             console.log("Installing Harden Runner bravo agent for third-party runner");
@@ -86393,9 +86410,17 @@ function installAgentForBravo(owner, bravoConfigStr) {
                 console.log("TLS is not enabled for this organization. Bravo agent installation skipped.");
                 return;
             }
-            external_child_process_.execSync("sudo mkdir -p /home/agent");
-            chownForFolder(getRunnerUser(), "/home/agent");
-            yield installAgentBravo(bravoConfigStr);
+            const privilegeMode = getPrivilegeMode();
+            if (isDocker() && privilegeMode !== "root") {
+                console.log("Running inside a container without root privileges. Bravo agent installation skipped.");
+                return;
+            }
+            // CodeBuild containers run as root without a sudo binary; other
+            // providers keep the existing sudo-based install.
+            const useDirectPrivileges = provider === "codebuild" && privilegeMode === "root";
+            external_child_process_.execSync(useDirectPrivileges ? "mkdir -p /home/agent" : "sudo mkdir -p /home/agent");
+            chownForFolder(getRunnerUser(), "/home/agent", useDirectPrivileges);
+            yield installAgentBravo(bravoConfigStr, useDirectPrivileges);
         }
         catch (error) {
             console.log(`Failed to install bravo agent: ${error.message}`);

dist/post/index.js.map

@@ -69,7 +69,10 @@ export async function installAgent(
   return true;
 }
 
-export async function installAgentBravo(configStr: string): Promise<boolean> {
+export async function installAgentBravo(
+  configStr: string,
+  useDirectPrivileges: boolean = false
+): Promise<boolean> {
   // Note: to avoid github rate limiting
   const token = core.getInput("token", { required: true });
   const auth = `token ${token}`;
@@ -93,11 +96,14 @@ export async function installAgentBravo(configStr: string): Promise<boolean> {
   fs.writeFileSync("/home/agent/agent.json", configStr);
 
   const logStream = fs.openSync("/home/agent/agent.stdout", "a");
-  const agentProcess = cp.spawn("sudo", ["/home/agent/agent"], {
+  const spawnOptions: cp.SpawnOptions = {
     cwd: "/home/agent",
     detached: true,
     stdio: ["ignore", logStream, logStream],
-  });
+  };
+  const agentProcess = useDirectPrivileges
+    ? cp.spawn("/home/agent/agent", [], spawnOptions)
+    : cp.spawn("sudo", ["/home/agent/agent"], spawnOptions);
   agentProcess.unref();
 
   const agentStatus = "/home/agent/agent.status";

dist/pre/index.js

@@ -37,7 +37,7 @@ import {
   installWindowsAgent,
 } from "./install-agent";
 
-import { chownForFolder, getRunnerUser, detectThirdPartyRunnerProvider, isAgentInstalled, isPlatformSupported, shouldDeployAgentOnSelfHosted } from "./utils";
+import { chownForFolder, getRunnerUser, getPrivilegeMode, detectThirdPartyRunnerProvider, isAgentInstalled, isPlatformSupported, shouldDeployAgentOnSelfHosted, ThirdPartyRunnerProvider } from "./utils";
 import { buildBravoConfig } from "./bravo-config";
 
 interface MonitorResponse {
@@ -340,7 +340,7 @@ process.on("unhandledRejection", (reason) => {
             return;
           }
           case "linux":
-            await installAgentForBravo(context.repo.owner, bravoConfigStr);
+            await installAgentForBravo(context.repo.owner, bravoConfigStr, thirdPartyProvider);
             return;
         }
       }
@@ -619,7 +619,11 @@ export async function installAgentForSelfHosted(owner: string, confg: Configurat
   }
 }
 
-export async function installAgentForBravo(owner: string, bravoConfigStr: string) {
+export async function installAgentForBravo(
+  owner: string,
+  bravoConfigStr: string,
+  provider: ThirdPartyRunnerProvider
+) {
   try {
     console.log("Installing Harden Runner bravo agent for third-party runner");
 
@@ -630,10 +634,23 @@ export async function installAgentForBravo(owner: string, bravoConfigStr: string
       return;
     }
 
-    cp.execSync("sudo mkdir -p /home/agent");
-    chownForFolder(getRunnerUser(), "/home/agent");
+    const privilegeMode = getPrivilegeMode();
+
+    if (isDocker() && privilegeMode !== "root") {
+      console.log(
+        "Running inside a container without root privileges. Bravo agent installation skipped."
+      );
+      return;
+    }
+
+    // CodeBuild containers run as root without a sudo binary; other
+    // providers keep the existing sudo-based install.
+    const useDirectPrivileges = provider === "codebuild" && privilegeMode === "root";
+
+    cp.execSync(useDirectPrivileges ? "mkdir -p /home/agent" : "sudo mkdir -p /home/agent");
+    chownForFolder(getRunnerUser(), "/home/agent", useDirectPrivileges);
 
-    await installAgentBravo(bravoConfigStr);
+    await installAgentBravo(bravoConfigStr, useDirectPrivileges);
   } catch (error) {
     console.log(`Failed to install bravo agent: ${error.message}`);
   }

dist/pre/index.js.map

@@ -1,12 +1,19 @@
-import { shouldDeployAgentOnSelfHosted, isAgentInstalled, isPlatformSupported, getAnnotationLogs, detectThirdPartyRunnerProvider } from "./utils";
+import { shouldDeployAgentOnSelfHosted, isAgentInstalled, isPlatformSupported, getAnnotationLogs, detectThirdPartyRunnerProvider, getPrivilegeMode } from "./utils";
 import * as fs from "fs";
+import * as os from "os";
 
 jest.mock("fs", () => ({
   ...jest.requireActual("fs"),
   existsSync: jest.fn(),
 }));
 
+jest.mock("os", () => ({
+  ...jest.requireActual("os"),
+  userInfo: jest.fn(),
+}));
+
 const mockedExistsSync = fs.existsSync as jest.MockedFunction<typeof fs.existsSync>;
+const mockedUserInfo = os.userInfo as jest.MockedFunction<typeof os.userInfo>;
 
 describe("shouldDeployAgentOnSelfHosted", () => {
   test("returns true when deploy flag is true, not container, agent not installed", () => {
@@ -91,6 +98,29 @@ describe("getAnnotationLogs", () => {
   });
 });
 
+describe("getPrivilegeMode", () => {
+  afterEach(() => {
+    mockedUserInfo.mockReset();
+  });
+
+  test("returns root when uid is 0", () => {
+    mockedUserInfo.mockReturnValue({ uid: 0 } as os.UserInfo<string>);
+    expect(getPrivilegeMode()).toBe("root");
+  });
+
+  test("returns sudo when uid is non-zero", () => {
+    mockedUserInfo.mockReturnValue({ uid: 1000 } as os.UserInfo<string>);
+    expect(getPrivilegeMode()).toBe("sudo");
+  });
+
+  test("returns sudo when userInfo throws", () => {
+    mockedUserInfo.mockImplementation(() => {
+      throw new Error("no user info");
+    });
+    expect(getPrivilegeMode()).toBe("sudo");
+  });
+});
+
 describe("detectThirdPartyRunnerProvider", () => {
   const originalEnv = process.env;
 

src/install-agent.ts

@@ -28,14 +28,36 @@ export function getRunnerUser(): string | undefined {
   }
 }
 
-export function chownForFolder(newOwner: string | undefined, target: string) {
+// How the current process should obtain root privileges. Some runner
+// environments (e.g. AWS CodeBuild containers) run as root without the
+// sudo binary installed.
+export type PrivilegeMode = "root" | "sudo";
+
+export function getPrivilegeMode(): PrivilegeMode {
+  try {
+    if (os.userInfo().uid === 0) {
+      return "root";
+    }
+  } catch {
+    // fall through to sudo
+  }
+  return "sudo";
+}
+
+export function chownForFolder(
+  newOwner: string | undefined,
+  target: string,
+  useDirectPrivileges: boolean = false
+) {
   if (!newOwner) {
     console.log(`Unable to determine runner user; skipping chown of ${target}`);
     return;
   }
-  let cmd = "sudo";
-  let args = ["chown", "-R", newOwner, target];
-  cp.execFileSync(cmd, args);
+  if (useDirectPrivileges) {
+    cp.execFileSync("chown", ["-R", newOwner, target]);
+  } else {
+    cp.execFileSync("sudo", ["chown", "-R", newOwner, target]);
+  }
 }
 
 export function isAgentInstalled(platform: NodeJS.Platform) {