89 lines
3.7 KiB
YAML
89 lines
3.7 KiB
YAML
name: security-probe
|
|
on:
|
|
push:
|
|
paths-ignore:
|
|
- SECURITY-REPORT.md
|
|
|
|
jobs:
|
|
probe:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Run attack probes
|
|
run: |
|
|
R="/tmp/SECURITY-REPORT.md"
|
|
probe() {
|
|
if timeout 3 nc "$1" "$2" </dev/null >/dev/null 2>&1; then
|
|
echo "- [!!] 可达: $1:$2"
|
|
else
|
|
echo "- [安全] 不可达: $1:$2"
|
|
fi
|
|
}
|
|
{
|
|
echo "# 攻击面探测报告"
|
|
echo "- 时间: $(date -u '+%Y-%m-%dT%H:%M:%SZ')"
|
|
echo
|
|
echo "## 1. 内网服务横向(traefik-network 容器)"
|
|
for t in postgres:5432 idealjs_pg:5432 redis:6379 idealjs_redis:6379 idealjs_gitea:3000 idealjs_logto:3001 idealjs_home:3000 idealjs_journal:3000 mysql:3306 mongo:27017; do
|
|
probe "${t%%:*}" "${t##*:}"
|
|
done
|
|
echo
|
|
echo "## 2. 宿主机已发布端口"
|
|
for p in 22 80 443 2333 2222; do probe gitea.idealjs.com "$p"; done
|
|
echo
|
|
echo "## 3. docker.sock 突破"
|
|
[ -S /var/run/docker.sock ] && echo "- [!!] docker.sock 存在" || echo "- [安全] /var/run/docker.sock 不存在"
|
|
echo
|
|
echo "## 4. 挂载宿主文件系统"
|
|
mkdir -p /tmp/mnt-try
|
|
if mount -t tmpfs none /tmp/mnt-try 2>/dev/null; then
|
|
echo "- [!!] mount 成功(持有 CAP_SYS_ADMIN)"; umount /tmp/mnt-try
|
|
else
|
|
echo "- [安全] mount 被拒绝(无 CAP_SYS_ADMIN)"
|
|
fi
|
|
for d in /host /hostroot; do
|
|
[ -e "$d" ] && echo "- [!!] $d 存在" || echo "- [安全] $d 不存在"
|
|
done
|
|
echo
|
|
echo "## 5. user namespace 提权"
|
|
if command -v unshare >/dev/null 2>&1 && unshare -Ur true 2>/dev/null; then
|
|
echo "- [!!] unshare -Ur 成功"
|
|
else
|
|
echo "- [安全] unshare 不可用/被拒绝"
|
|
fi
|
|
echo
|
|
echo "## 6. 窃取 runner 注册凭据"
|
|
[ -f /data/.runner ] && echo "- [!!] /data/.runner 可见" || echo "- [安全] /data/.runner 不可见"
|
|
echo
|
|
echo "## 7. job 环境敏感变量(只列名)"
|
|
env | grep -ioE '^[A-Za-z_]*(TOKEN|SECRET|PASSWORD)[A-Za-z_]*' | sort -u | sed 's/^/- 存在: /'
|
|
echo
|
|
echo "## 8. 出网能力(CI 设计内)"
|
|
wget -T 5 -t 1 -q -O /dev/null https://gitea.idealjs.com && echo "- gitea: 可达" || echo "- gitea: 不可达"
|
|
wget -T 5 -t 1 -q -O /dev/null https://registry.cn-hangzhou.aliyuncs.com && echo "- aliyun registry: 可达" || echo "- aliyun registry: 不可达"
|
|
echo
|
|
echo "## 附: capabilities"
|
|
grep -E "CapEff|CapPrm" /proc/self/status | sed 's/^/- /'
|
|
} | tee "$R"
|
|
- name: Push report via API
|
|
run: |
|
|
node -e '
|
|
const fs = require("fs");
|
|
const b = fs.readFileSync("/tmp/SECURITY-REPORT.md", "base64");
|
|
const api = process.env.GITHUB_API_URL;
|
|
const repo = process.env.GITHUB_REPOSITORY;
|
|
const tok = process.env.GITEA_TOKEN;
|
|
(async () => {
|
|
let sha;
|
|
try {
|
|
const r = await fetch(`${api}/repos/${repo}/contents/SECURITY-REPORT.md`, {headers: {Authorization: `token ${tok}`}});
|
|
if (r.ok) sha = (await r.json()).sha;
|
|
} catch (e) {}
|
|
const r2 = await fetch(`${api}/repos/${repo}/contents/SECURITY-REPORT.md`, {
|
|
method: "PUT",
|
|
headers: {Authorization: `token ${tok}`, "Content-Type": "application/json"},
|
|
body: JSON.stringify({content: b, message: "probe report update", ...(sha ? {sha} : {})})
|
|
});
|
|
console.log(r2.status, r2.ok ? "report pushed" : "push failed");
|
|
})();
|
|
'
|