Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I'm creating a server that is in charge of building code. This server should be able to run arbitrary building scripts without those being able to harm the server. For example by modifying configuration files, tampering binaries or stealing secrets in home.
Do you have any tips for this?
This isn’t a simple answer. There are tools specific to different operating systems like Windows or Linux that perform file integrity monitoring. Be aware that things like system or build tool updates can create a lot of false positives.
There are some things you can do around checking code but that will generally add a lot of management overhead. Are these scripts coming from untrusted sources or do you want to double check that internal developers aren’t doing anything bad?
One of the easiest things to do is network segmentation. Make sure the box is isolated in an environment where it can build properly but connections originating from this box can’t connect to other systems. This will help even if someone does manage to sneak something malicious in there is isn't a path for it to get out compromise other machines.
You should checkout gVisor, you can use it to isolate containers running these builds from the host machine, if you're planning on using containers. I believe GCP uses gVisor in some capacity. Either way you should be able to run potentially malicious code without it affecting the host machine.
