Rules / GL050

GL050 sudo usage in CI script

Severity: warn
OWASP: CICD-SEC-7 – Insecure System Configuration
CWE: CWE-250 – Execution with Unnecessary Privileges

Risk

sudo in a CI script signals one of two problems:

1. Runner runs as non-root, script escalates to root — any compromise in the executed code (malicious dependency, injected variable, supply-chain attack) gains full root access to the runner host. Privilege escalation turns a contained incident into a full runner compromise.

2. Runner already runs as root, sudo is unnecessary — common on shared GitLab.com runners. The sudo is redundant and signals a misconfigured or poorly understood runner setup.

In both cases sudo in a pipeline script is a security smell.

What is flagged

Script lines (in script:, before_script:, after_script:, or a run: step) that contain sudo as a standalone word. Shell comment lines (starting with #) are not flagged.

Trigger example

build:
  script:
    - sudo apt-get install -y nodejs
    - sudo make install

Safe alternatives

# Use a purpose-built image that already has the tools installed
build:
  image: node:20.11.1
  script:
    - make install

# On shared runners that already run as root, drop sudo entirely
build:
  script:
    - apt-get install -y nodejs
    - make install

Notes

• sudo as a substring of another word (e.g. pseudocode) is not flagged
• The root fix is usually to use a container image with required tools pre-installed, avoiding system package installation in CI entirely

Documentation for glsec 1.23.0. Source of this page · Rule implementation