Unexpected blockage of multicast socket

[therealryan]

The testing for my project involves running some toy services that use multicast UDP to discover each other.

This socket usage is not detected in audit mode (example report), but it is blocked when the suggested blocking egress-policy is put in place (PR, build). The build had to be cancelled when the relevant test hung, but the build logs shows:

Error: Exception in thread "Discovery advertise" java.io.UncheckedIOException: java.io.IOException: Operation not permitted (sendto failed)
	at com.mastercard.test.flow.example.framework.Discovery.lambda$advertise$0(Discovery.java:97)
	at java.lang.Thread.run(Thread.java:750)
Caused by: java.io.IOException: Operation not permitted (sendto failed)
	at java.net.PlainDatagramSocketImpl.send(Native Method)
	at java.net.DatagramSocket.send(DatagramSocket.java:693)
	at com.mastercard.test.flow.example.framework.Discovery.lambda$advertise$0(Discovery.java:84)
	... 1 more

I'm not at all sure whether multicast UDP presents an exfiltration risk in the context of a github action. Defaulting to blocking it is thus probably the correct position, but it'd be great if it showed up in the audit and could be added to the allowed operation set.

Cheers!

[varunsh-coder]

Thanks, @therealryan, for using harden runner and creating this issue. Let me investigate and get back to you. Thanks!

[varunsh-coder]

@h0x0er please investigate this. Thanks!