[Security Review] 🔐 Daily Security Review & Threat Model – 2026-07-04

[github-actions[bot]]

🔐 Daily Security Review & Threat Model

Date: 2026-07-04 | Repo: github/gh-aw-firewall v0.23.1

📊 Executive Summary

Overall posture is strong. The firewall implements defense-in-depth: iptables (host + agent), Squid L7 domain-ACL, seccomp, capability drop, tmpfs credential overlays, and one-shot token isolation. 0 critical findings. The escape test (Secret Digger) confirmed credential isolation works: agent produced only noop outputs — no secrets exposed.

Metrics: 5,802 lines security-critical code · 4 enforcement layers · 0 npm vulns · 28 credential overlays · 18 STRIDE threats evaluated → 0 critical / 2 high / 3 medium / 3 low

---

🔍 Escape Test Results

/tmp/gh-aw/escape-test-summary.txt = Secret Digger (Copilot) workflow metadata:

• GH_AW_AGENT_CONCLUSION: success · GH_AW_SECRET_VERIFICATION_RESULT: success
• Agent output: noop — no secrets found or filed

Verdict: Credential isolation (API proxy placeholder tokens + workDir tmpfs) worked correctly in practice.

---

🛡️ Architecture Analysis

Network (src/host-iptables-rules.ts, containers/agent/setup-iptables.sh)

• Host FW_WRAPPER chain: Squid gets unconditional ACCEPT; DNS whitelisted; IPv6 disabled via sysctl when ip6tables unavailable
• Agent NAT+OUTPUT: HTTP/HTTPS DNAT'd to Squid:3128; dangerous ports (22, 25, DBs, Redis, Mongo) NAT RETURN + LOG + DROP; audit prefixes [FW_BLOCKED_DANGEROUS_PORT], [FW_BLOCKED_TCP], [FW_BLOCKED_UDP_AGENT] (rate-limited)
• Key: NET_ADMIN never granted to agent — isolated to awf-iptables-init init container

Container (src/services/agent-service.ts:68-103)

cap_add:  [SYS_CHROOT, SYS_ADMIN]  # dropped via capsh before user code
cap_drop: [NET_RAW, SYS_PTRACE, SYS_MODULE, SYS_RAWIO, MKNOD]
security_opt: [no-new-privileges:true, seccomp=<profile>, apparmor:unconfined]
mem_limit: 6g · pids_limit: 1000

• Seccomp: defaultAction: SCMP_ACT_ERRNO (deny-by-default); ptrace/process_vm_readv/pivot_root/keyctl/kexec/umount all ERRNO
• 28 credential overlays (/dev/null at container + /host/ paths: .aws, .ssh, .kube, .docker, .azure, etc.)
• workDir hidden via tmpfs (noexec, nosuid, 1MB) — prevents reading docker-compose.yml tokens
• hidepid=2 on procfs — blocks reading /proc/1/environ
• One-shot token: tokens unset from PID 1 after 1s; LD_PRELOAD one-shot-token.so on glibc hosts

Domain Validation (src/domain-validation.ts)

5-layer Squid injection prevention: empty → dangerous chars [\s\0"'\;#\] → over-broad patterns (, .*) → structural validity (double-dots, wildcard count) → protocol prefix strip. Direct IP connections blocked via dstdom_regex` in Squid ACL.

Input Validation (src/parsers/)

joinShellArgs uses safe '\'' escaping; volume mounts require absolute paths; env vars use strict KEY=VALUE regex; UID/GID validated as numeric non-zero.

---

⚠️ STRIDE Threat Summary

Category	Key Threats	Status
Spoofing	Agent impersonates Squid; DNS spoofing	✅ Mitigated (healthcheck dep, DNS whitelist)
Tampering	--allow-domains Squid injection; YAML injection; volume path traversal	✅/⚠️ Char allowlist + sanitizer; path not normalized
Repudiation	Blocked domain access; L3 traffic unlogged	✅ JSONL audit log + [FW_BLOCKED_*] kernel logs
Info Disclosure	/proc/1/environ token race; docker-compose.yml; credential files; musl fallback	✅/⚠️ hidepid=2 + tmpfs + overlays; timing gap on musl
Denial of Service	Fork bomb; memory exhaustion; log flooding	✅ pids_limit + mem_limit + rate-limited LOG
Elevation of Privilege	SUID escalation; chroot escape; setns namespace escape; AppArmor unconfined	✅/⚠️ no-new-priv + capsh; setns allowed without type filter; no MAC

---

✅ Recommendations

🟠 High

H1: AppArmor unconfined removes MAC layer

• src/services/agent-service.ts:92 — required for procfs mount in entrypoint, but removes all MAC enforcement
• Fix: Add post-drop assertion: capsh --print | grep -v sys_admin to detect silent drop failure; or generate a minimal AppArmor profile allowing only mount of type proc

H2: setns allowed in seccomp without namespace type filter

• containers/agent/seccomp-profile.json — setns into a network namespace could bypass isolation in DinD/co-tenant environments without requiring SYS_ADMIN
• Fix: Add seccomp args filter restricting setns to non-network namespace types, or block entirely if no runtime requires it

🟡 Medium

M1: one-shot-token.so musl/Alpine incompatibility

• containers/agent/entrypoint.sh:552-558 — fallback to 1s timing window on Alpine hosts; fast agent could race /proc/1/environ read
• Fix: Build musl-compatible variant, or clear tokens synchronously before exec-ing agent

M2: Volume mount path not canonicalized

• src/parsers/volume-parsers.ts — /workspace/../etc/shadow passes startsWith('/') check
• Fix: path.resolve(hostPath) + block sensitive prefixes (/etc, /proc, /sys, /dev, /root)

M3: Token window in run_agent_with_token_protection

• containers/agent/entrypoint.sh:471-493 — 0–1s window; primary mitigation is hidepid=2
• Fix: Add startup smoke test asserting awfuser cannot read /proc/1/environ (expect EACCES)

🟢 Low

L1: Document in LOGGING.md that audit_jsonl omits User-Agent intentionally (JSON injection prevention)

L2: Block UIDs 1–99 (system accounts) in addition to UID 0 in entrypoint.sh:30-37

L3: Extend compose-sanitizer.ts redaction pattern to include PASSWORD|CREDENTIAL|PAT|BEARER|AUTHORIZATION

---

📋 Key Evidence

Seccomp defaultAction: SCMP_ACT_ERRNO (deny-by-default)
Allowed dangerous: chroot, mount, clone, unshare, setns
Blocked: ptrace, process_vm_readv/writev, pivot_root, keyctl, kexec, umount

npm audit: 0 vulnerabilities (info=0 low=0 moderate=0 high=0 critical=0)

iptables agent rules:
  DNAT tcp:80,443 → SQUID_IP:3128
  NAT RETURN dangerous ports → OUTPUT DROP
  LOG [FW_BLOCKED_*] --limit 5-10/min

Credential overlays (28 total):
  .aws/credentials .aws/config .ssh/id_* .docker/config.json
  .kube/config .azure/credentials .config/gcloud/credentials.db
  (each at both container path and /host/ path)

---

Automated security review · 2026-07-04 · v0.23.1

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by Daily Security Review and Threat Modeling · 110.4 AIC · ⊞ 6.5K · ◷

• expires on Jul 11, 2026, 7:58 AM UTC

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-07-11T07:58:50.892Z.

Closed by Workflow