Running sudo commands on selfhosted runner? #3576

AnderssonPeter · 2024-11-15T21:19:46Z

AnderssonPeter
Nov 15, 2024

Hi I'm running a script using a self hosted github action runner but when I try to run a sudo command I get the error:

sudo: The "no new privileges" flag is set, which prevents sudo from running as root.
sudo: If sudo is running in a container, you may need to adjust the container configuration to disable the flag.

So I checked SystemD Service defintion and found NoNewPrivileges=true so I changed it to false and restarted the service.
But I still get the same error, are there any other settings that could stop me from running sudo commands?

The SystemD service Definition is below:

[Unit]
After=network.target network-online.target
Description=GitHub Actions runner
Wants=network-online.target

[Service]
Environment="HOME=/opt/github-runner"
Environment="LOCALE_ARCHIVE=/nix/store/b7dsnpdzj51zxvxwwpvqlj6hyywp8ic8-glibc-locales-2.39-52/lib/locale/locale-archive"
Environment="PATH=/nix/store/syl4snn859kpqvn9qh91kr7n9i4dws04-bash-5.2p32/bin:/nix/store/hazsx60lrysd393fw7z7vpy4g6gn4acd-coreutils-9.5/bin:/nix/store/6yszhb3mbar672imyx6zfcgpvqh8i44l-git-2.44.2/bin:/nix/store/gnnfd78winj1lc3xb0z7j6wzm35wybwc-gnutar-1.35/bin:/nix/store/xmvlam256mq7lv32mf8rxmb76pznvdsk-gzip-1.13/bin:/nix/store/ixjixjj9f1k7h8rqab8frjhl6gm8k466-nix-2.18.8/bin:/nix/store/s4fcvic1pi8m4jqf9vi39amd7b6gxxmc-powershell-7.4.2/bin:/nix/store/k4wv1x26rba1hz725dcsawlzfpg3ywbl-sudo-1.9.15p5/bin:/nix/store/hazsx60lrysd393fw7z7vpy4g6gn4acd-coreutils-9.5/bin:/nix/store/749gm6fvnqph38vpg8b0jy6imxhq5bbf-findutils-4.9.0/bin:/nix/store/da0r6y8bzs9jn9d3p1mmv0vxmi1d80ab-gnugrep-3.11/bin:/nix/store/gi25l7za3bwy9havx02p7s201z0iykgk-gnused-4.9/bin:/nix/store/h05qs7dk5i6490ji0f9fndia9q2wwjac-systemd-255.9/bin:/nix/store/syl4snn859kpqvn9qh91kr7n9i4dws04-bash-5.2p32/sbin:/nix/store/hazsx60lrysd393fw7z7vpy4g6gn4acd-coreutils-9.5/sbin:/nix/store/6yszhb3mbar672imyx6zfcgpvqh8i44l-git-2.44.2/sbin:/nix/store/gnnfd78winj1lc3xb0z7j6wzm35wybwc-gnutar-1.35/sbin:/nix/store/xmvlam256mq7lv32mf8rxmb76pznvdsk-gzip-1.13/sbin:/nix/store/ixjixjj9f1k7h8rqab8frjhl6gm8k466-nix-2.18.8/sbin:/nix/store/s4fcvic1pi8m4jqf9vi39amd7b6gxxmc-powershell-7.4.2/sbin:/nix/store/k4wv1x26rba1hz725dcsawlzfpg3ywbl-sudo-1.9.15p5/sbin:/nix/store/hazsx60lrysd393fw7z7vpy4g6gn4acd-coreutils-9.5/sbin:/nix/store/749gm6fvnqph38vpg8b0jy6imxhq5bbf-findutils-4.9.0/sbin:/nix/store/da0r6y8bzs9jn9d3p1mmv0vxmi1d80ab-gnugrep-3.11/sbin:/nix/store/gi25l7za3bwy9havx02p7s201z0iykgk-gnused-4.9/sbin:/nix/store/h05qs7dk5i6490ji0f9fndia9q2wwjac-systemd-255.9/sbin"
Environment="RUNNER_ROOT=%S/github-runner/github-runner"
Environment="TZDIR=/nix/store/9kcxc7476dghdz3rpfi32mz0pzclsxbj-tzdata-2024b/share/zoneinfo"
AmbientCapabilities=
BindPaths=/opt/github-runner
BindPaths=/opt/containers
CapabilityBoundingSet=
DeviceAllow=
DynamicUser=false
ExecStart=/nix/store/i46xkb43dkx95xfr386i7g3m2bkd7g94-github-runner-2.320.0/bin/Runner.Listener run --startuptype service
ExecStartPre=+/nix/store/wsa0drj2izrciki3hk7ink9y61iw0725-github-runner-github-runner-unconfigure.sh '%S/github-runner/github-runner' '/opt/github-runner' '%L/github-runner/github-runner'
ExecStartPre=/nix/store/s8llwdk9g488vfz13xn26b9flldl4yy4-github-runner-github-runner-configure.sh '%S/github-runner/github-runner' '/opt/github-runner' '%L/github-runner/github-runner'
ExecStartPre=/nix/store/1y7qcc6a5ylsqazif5fbw23iiv0isaav-github-runner-github-runner-setup-work-dirs.sh '%S/github-runner/github-runner' '/opt/github-runner' '%L/github-runner/github-runner'
Group=container-deployment
InaccessiblePaths=-/opt/secrets/github-runner-token
InaccessiblePaths=%S/github-runner/github-runner/.current-token
KillSignal=SIGINT
LockPersonality=false
LogsDirectory=github-runner/github-runner
MemoryDenyWriteExecute=false
NoNewPrivileges=false
PrivateDevices=true
PrivateMounts=true
PrivateNetwork=false
PrivateTmp=true
PrivateUsers=true
ProcSubset=all
ProtectClock=true
ProtectControlGroups=true
ProtectHome=true
ProtectHostname=true
ProtectKernelLogs=true
ProtectKernelModules=true
ProtectKernelTunables=true
ProtectProc=invisible
ProtectSystem=strict
RemoveIPC=true
Restart=no
RestartForceExitStatus=2
RestrictAddressFamilies=AF_INET
RestrictAddressFamilies=AF_INET6
RestrictAddressFamilies=AF_UNIX
RestrictAddressFamilies=AF_NETLINK
RestrictNamespaces=true
RestrictRealtime=true
RestrictSUIDSGID=true
RuntimeDirectory=github-runner/github-runner
StateDirectory=github-runner/github-runner
StateDirectoryMode=0700
SystemCallFilter=~@clock
SystemCallFilter=~@cpu-emulation
SystemCallFilter=~@module
SystemCallFilter=~@mount
SystemCallFilter=~@obsolete
SystemCallFilter=~@raw-io
SystemCallFilter=~@reboot
SystemCallFilter=~capset
SystemCallFilter=~setdomainname
SystemCallFilter=~sethostname
UMask=0006
User=container-deployment
WorkingDirectory=/opt/github-runner

[Install]
WantedBy=multi-user.target

I have configured some sudo commands that the user running the Service is allowed to run without providing a password, and i have verified that I'm allowed to run them without password by switching to the user and running the sudo commands.

AnderssonPeter · 2024-11-19T20:12:30Z

AnderssonPeter
Nov 19, 2024
Author

It seems there are other settings that enable the NoNewPrivileges even when it's set to false

NoNewPrivileges
Takes a boolean argument. If true, ensures that the service process and all its children can never gain new privileges through execve() (e.g. via setuid or setgid bits, or filesystem capabilities). This is the simplest and most effective way to ensure that a process and its children can never elevate privileges again. Defaults to false, but certain settings override this and ignore the value of this setting. This is the case when SystemCallFilter=, SystemCallArchitectures=, RestrictAddressFamilies=, RestrictNamespaces=, PrivateDevices=, ProtectKernelTunables=, ProtectKernelModules=, MemoryDenyWriteExecute=, RestrictRealtime=, RestrictSUIDSGID=, DynamicUser= or LockPersonality= are specified. Note that even if this setting is overridden by them, systemctl show shows the original value of this setting. See also: No New Privileges Flag.

Source: Source: https://gist.github.com/ageis/f5595e59b1cddb1513d1b425a323db04

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Running sudo commands on selfhosted runner? #3576

Uh oh!

{{title}}

Uh oh!

Replies: 1 comment

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Select a reply

Uh oh!

Running sudo commands on selfhosted runner? #3576

Uh oh!

AnderssonPeter Nov 15, 2024

Replies: 1 comment

Uh oh!

Uh oh!

AnderssonPeter Nov 19, 2024 Author

AnderssonPeter
Nov 15, 2024

AnderssonPeter
Nov 19, 2024
Author