[Security Review] Daily Security Review & Threat Model — 2026-07-07

[github-actions[bot]]

📊 Executive Summary

Evidence-based daily security review of gh-aw-firewall v0.23.1 (commit 5160f8f). Overall posture is strong — well-implemented defense-in-depth with L7 Squid + L3/L4 iptables + container capability restrictions + seccomp + procfs isolation. No critical or high severity findings. 0 npm vulnerabilities.

Escape-test context: The pre-fetched /tmp/gh-aw/escape-test-summary.txt contained a "Secret Digger (Copilot)" workflow conclusion log (2026-04-11). GH_AW_SECRET_VERIFICATION_RESULT: success, GH_AW_AGENT_CONCLUSION: success with only noop output — no credentials found, no escapes.

---

🔍 Findings

Medium Severity

M1 — ICMP not blocked in OUTPUT filter chain (setup-iptables.sh:459-462)

iptables -A OUTPUT -p tcp -j DROP
iptables -A OUTPUT -p udp -j DROP
# MISSING: iptables -A OUTPUT -p icmp -j DROP

Allows ICMP covert-channel exfiltration (ping tunneling, ICMP echo payload encoding). Recommendation: Add:

iptables -A OUTPUT -p icmp -m limit --limit 10/min --limit-burst 20 -j LOG --log-prefix "[FW_BLOCKED_ICMP] " --log-level 4 --log-uid
iptables -A OUTPUT -p icmp -j DROP

M2 — unshare syscall allowed in seccomp (containers/agent/seccomp-profile.json:338)

unshare is in the SCMP_ACT_ALLOW group. On kernels with kernel.unprivileged_userns_clone=1, an agent can call unshare --user to create a user namespace and gain a full capability set within it, potentially enabling namespace-based escalation. no-new-privileges:true limits but does not fully eliminate this path. Recommendation: Remove unshare from the ALLOW group.

M3 — AppArmor disabled (apparmor:unconfined) (src/services/agent-service.ts:97)

Required because Docker's default AppArmor profile blocks mount, which is needed for procfs setup (entrypoint.sh:521). Disabling AppArmor removes a defense layer — a regressed capsh capability drop could be exploited without AppArmor confinement. Recommendation: Create a minimal custom AppArmor profile permitting only mount fstype=proc.

M4 — Agent↔API-proxy channel is unencrypted HTTP (containers/api-proxy/)

The agent calls (172.30.0.30/redacted) with no auth; the sidecar injects real keys and forwards via Squid. While awf-netis isolated, a compromised Squid container could observe/inject plaintext traffic on this channel. **Recommendation:** Add mTLS using per-session ephemeral certs (reusesrc/ssl-bump.ts` CA infrastructure).

Low Severity

L1 — IPv4 DNS validation allows octets > 255 (setup-iptables.sh:14)

echo "$ip" | grep -qE '^([0-9]{1,3}\.){3}[0-9]{1,3}$'

Matches 999.999.999.999. Doesn't enable injection (iptables rejects it) but causes confusing failures. Add numerical bounds checking per-octet.

L2 — chmod 666 on Claude config files (entrypoint.sh:232,237,262)

World-writable API config files. Change to chmod 640 with awfuser ownership.

L3 — One-shot token library disabled on musl/Alpine (entrypoint.sh:553)

On incompatible hosts, [WARN] Token protection will be disabled — tokens remain in /proc/1/environ for a ~1s race window. hidepid=2 mitigates but doesn't fully close this. Upgrade to a security-audit-level log entry so operators detect degraded token protection.

L4 — ReDoS risk in --allow-urls regex patterns (src/squid/ssl-bump.ts:37)

Only assertSafeForSquidConfig() (injection chars) applied to URL patterns. Nested quantifiers (e.g., (a+)+) could trigger ReDoS in Squid's regex engine under high traffic. Add complexity heuristics.

---

⚠️ Threat Model (STRIDE)

Category	Threat	Severity
Spoofing	Agent impersonates Squid via internal ARP	Low
Spoofing	MITM on agent→api-proxy HTTP channel	Medium
Tampering	Regex injection into Squid config via --allow-urls	Medium
Info Disclosure	ICMP covert-channel exfiltration	Medium
Info Disclosure	Token race on musl/Alpine hosts	Medium
Info Disclosure	unshare --user + user namespace escalation	Medium
Denial of Service	ReDoS via --allow-urls patterns	Low
Elevation of Privilege	mount + no AppArmor after capsh regression	Medium

---

📈 Security Metrics

Metric	Value
Security-critical code analyzed	2,551 lines
Attack surfaces identified	12
Critical/High findings	0
Medium findings	4
Low findings	4
npm vulnerabilities	0
Syscalls blocked (notable)	ptrace, process_vm_readv/writev, kexec_load, bpf, keyctl
Dangerous ports blocked	15
Seccomp allowed syscalls	341

Review date: 2026-07-07 | v0.23.1 @ 5160f8f

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by Daily Security Review and Threat Modeling · 138.3 AIC · ⊞ 6.5K · ◷

• expires on Jul 14, 2026, 8:11 AM UTC

[github-actions[bot]]

🔮 The ancient spirits stir around this discussion; the smoke test agent was here, and the omens were observed.

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

• awmgmcpg
• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

[github-actions[bot]]

🔮 The ancient spirits stir, and the smoke-test agent has passed through this hall. The omens are favorable.

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

• awmgmcpg
• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

[github-actions[bot]]

🔮 The ancient spirits stir. The smoke test agent was here, and the omens are green.

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

• awmgmcpg
• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

[github-actions[bot]]

🔮 The ancient spirits stir. The smoke test agent was here, and the omens were read.

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

• awmgmcpg
• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

[github-actions[bot]]

🔮 The ancient spirits stir, and the smoke test agent has passed through.

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

• awmgmcpg
• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

[github-actions[bot]]

🔮 The ancient spirits stir: the smoke test agent was here.

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

• awmgmcpg
• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

[github-actions[bot]]

🔮 The ancient spirits stir, and the smoke test agent was here.

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

• awmgmcpg
• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

[github-actions[bot]]

🔮 The ancient spirits stir: the smoke test agent passed through GitHubs veil, and this discussion bears witness.

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

• awmgmcpg
• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}