Need: Reduce students' right in action runner #93

New Issue

梁诗睿524370910152 · 2025-10-25T11:57:23+08:00

2025-10-25 11:57:23 +08:00

Thanks to Cai Yuxiang's idea, I have found that its very simple for student to bypass JOJ and do whatever they want in the runner without alarming TAs.
Basically, students only need to delete JOJ command in the yaml files and put whatever commands they want. Since the Health-check is triggered by JOJ, no Health-check will be run without JOJ command so the action ends with green tick.
Then, e.g., since joj repo is mounted under /home/tt/, students could easily use ls -Ra and cat to find the hidden cases.
Also, students has sudo permission in the runner, it's possible for students to ddos the server.

Thanks to Cai Yuxiang's idea, I have found that its very simple for student to bypass JOJ and do whatever they want in the runner without alarming TAs. Basically, students only need to delete JOJ command in the `yaml` files and put whatever commands they want. Since the `Health-check` is triggered by JOJ, no `Health-check` will be run without JOJ command so the action ends with green tick. Then, e.g., since `joj` repo is mounted under `/home/tt/`, students could easily use `ls -Ra` and `cat` to find the hidden cases. Also, students has `sudo` permission in the runner, it's possible for students to ddos the server.

梁诗睿524370910152 added the

bug

label 2025-10-25 11:57:23 +08:00

manuel was assigned by 梁诗睿524370910152

2025-10-25 11:57:23 +08:00

张泊明518370910136 was assigned by 梁诗睿524370910152

2025-10-25 11:57:23 +08:00

张泊明518370910136 commented

2025-10-25 12:04:18 +08:00

You can try this and see if it works.

张泊明518370910136 closed this issue

2025-10-25 12:04:18 +08:00

梁诗睿524370910152 commented

2025-10-25 17:27:40 +08:00

Yes I have tried and it worked. Here is the procedures:
I modify push.yaml and run ls /home/tt/.config/joj/xxx and this action provides the output. Then I use git restore source=xxxx -- .gitea/workflows/push.yaml and push again, the action is triggered normally. TAs won't find out unless they check the details of every action.

Yes I have tried and it worked. Here is the procedures: I modify push.yaml and run `ls /home/tt/.config/joj/xxx` and [this action](https://focs.ji.sjtu.edu.cn/git/engr151/test-repo/actions/runs/613) provides the output. Then I use `git restore source=xxxx -- .gitea/workflows/push.yaml` and push again, [the action](https://focs.ji.sjtu.edu.cn/git/engr151/test-repo/actions/runs/614) is triggered normally. TAs won't find out unless they check the details of every action.

梁诗睿524370910152 reopened this issue

2025-10-25 17:27:40 +08:00

张泊明518370910136 commented

2025-10-25 23:16:18 +08:00

OK. Wrong setup will grant unnecessary permission to that user. Now it is enforced when push in course-joj repo is triggered.

张泊明518370910136 closed this issue

2025-10-25 23:16:18 +08:00

张泊明518370910136 commented

2025-10-26 00:54:35 +08:00

Now enforced in runner-images.

Sign in to join this conversation.