MacOS and Windows support

[ericcornelissen]

It would be very nice if harder-runner could be used when using the MacOS or Windows runners. I'm afraid this is non-trivial to achieve (especially for Windows), but I do think it would be a worthwhile endeavor in the long run.

While I'm not familiar enough with this project to know the level of effort required, initial steps towards supporting MacOS and Windows would probably include:

• Compiling the agent to MacOS and Windows. This should be trivial, given it's written in Go.
• Updating this Action's source code to use the NodeJS API over using child_process to call CLI utilities. E.g. using fs.mkdir instead of executing mkdir.

[varunsh-coder]

Thanks @ericcornelissen for adding this idea! I agree it would be great to have this for MacOS and Windows. I think in addition to the changes you mentioned, the underlying tech to monitor the OS and set firewall rules will also be different. e.g. on Ubuntu, harden-runner agent uses auditd and iptables in addition to a dns proxy. The dns proxy should work as-is, but auditing files, processes, and network calls will need more investigation for MacOS and Windows.

[reactive-firewall]

Tip

MacOS ships with at-least two (2) firewalls:

• pf (and utils like pfctl) is a 3rd generation type firewall much like iptables (caveat: note the rule evaluation used by pf is fundamentally different than the chain style of iptables). Darwin's proprietary pf seems based on FreeBDS PF.
• /usr/libexec/ApplicationFirewall/socketfilterfw (and the firewall system settings in the GUI) is an application firewall (layer-7 type) and can not always be audited (e.g. after entering macOS rootless mode, the CLI will not accuratly output large rule-sets by default 🤷)

Together these tools should provide significant control over network hardening.

MacOS can create auditing taps with ifconfig for pf's traffic.
e.g.

    ifconfig pflog0
    sudo tcpdump -i pflog0

[fab1an]

I think this is needed more and more often, not only for Mac-only software.

I maintain a kotlin-multiplatform library that needs an macos runner to build everything for apple.