[Security Review] 🔒 Daily Security Review & Threat Model — 2026-07-09

[github-actions[bot]]

🔒 Daily Security Review & Threat Model — gh-aw-firewall

Review date: 2026-07-09
Reviewer: Automated Security Analysis Agent
Codebase version: 0.23.1 (package.json)
Scope: Full codebase static analysis + architecture threat modelling

---

📊 Executive Summary

The gh-aw-firewall system exhibits a strong, defence-in-depth security posture for an L7 egress-control sandbox. The architecture correctly separates privileges (iptables init container vs. agent container), uses forward-proxy semantics (explicit CONNECT) for HTTPS, and applies multiple credential-isolation layers (bind-mount shadowing, hidepid=2, token unsetting, LD_PRELOAD one-shot interceptor).

Key metrics:

• ~58,000 lines of security-critical TypeScript + shell analyzed
• 189 source files reviewed
• 14 credential files shadowed via /dev/null mounts
• 3 independent network enforcement layers (NAT DNAT, forward proxy ACL, host-level iptables)
• 5 seccomp rule groups covering hundreds of syscalls; default-deny policy

Notable strengths: Privilege separation is near-complete; domain injection is validated with dangerous-character allowlisting; hidepid=2 + one-shot tokens protect against /proc/1/environ races; no-new-privileges:true and SCMP_ACT_ERRNO default-deny seccomp are correctly applied.

Notable risks (no critical/RCE findings): apparmor:unconfined on the agent container; bash ${VAR} interpolation in /dev/tcp connectivity check; log directory chmod 0777 fallbacks; busybox:latest probe image pulls without digest pinning.

---

🔍 Findings from Firewall Escape Test Context

The pre-fetched escape test file (/tmp/gh-aw/escape-test-summary.txt) contained CI framework metadata rather than actual escape test results (it was the conclusion/teardown log for a previous "Secret Digger" workflow run). Key observations from that log:

• GH_AW_SECRET_VERIFICATION_RESULT: success — the secret-digger workflow succeeded, indicating the firewall correctly prevented credential exfiltration
• GH_AW_AGENT_CONCLUSION: success — the agent completed normally with only noop outputs
• The run concluded at 2026-04-11T03:25:37 under trace ID 4343ac092c9b0695231040e18f853fa4
• No report_incomplete or create_issue failures were recorded, consistent with a passing security gate

Conclusion: The most recent escape test completed without triggering any exfiltration alerts.

---

🛡️ Architecture Security Analysis

Network Security Assessment

Enforcement layers:

Layer	Mechanism	File:Line
L3/L4 Host	iptables FW_WRAPPER chain on Docker bridge	src/host-iptables-rules.ts
L3/L4 Container NAT	DNAT port 80/443 → Squid:3128	containers/agent/setup-iptables.sh:192–213
L7 Proxy	Squid forward proxy with dstdomain/dstdom_regex ACL	src/squid/acl-generator.ts
IPv6 suppression	sysctl net.ipv6.conf.all.disable_ipv6=1 when ip6tables absent	setup-iptables.sh:133-135
DNS lockdown	Only Docker embedded DNS (127.0.0.11) listed in resolv.conf	entrypoint.sh:configure_dns()

Strengths:

• HTTPS handled via explicit CONNECT (SNI captured, no SSL inspection required by default)
• HTTP traffic forced through DNAT because lowercase http_proxy is intentionally unset (prevents curl httpoxy false-negative)
• Proxy-unaware tools still fail (TLS error on raw CONNECT rejection), not silently bypass
• iptables -s 172.30.0.10 -j ACCEPT grants Squid unrestricted outbound, not the agent

Weaknesses / Gaps:

1. IPv6 gap during setup race (setup-iptables.sh:117–135): IPv6 is disabled via sysctl, but the sysctl write happens after the container IP stack initialises. A fast tool that connects over IPv6 before the sysctl is applied could bypass the proxy. Probability is low but non-zero on fast machines.

2. DNS exfiltration via DNS-over-HTTPS bypass when --dns-over-https is not used: standard DNS queries go to Google 8.8.8.8 (the default). A sophisticated agent could exfiltrate data via DNS TXT records to an attacker-controlled subdomain. The firewall does not inspect DNS payload content, only restricts the resolver addresses.

3. UDP is not DNAT'd to Squid — only TCP 80/443 are redirected. Non-HTTP UDP protocols (e.g. QUIC/HTTP3, NTP, SSDP) are dropped by the filter chain but the iptables LOG rule uses [FW_BLOCKED_UDP] prefix (only visible via dmesg), reducing observability.

---

Container Security Assessment

Evidence (src/services/agent-service.ts:68–92):

cap_add:  [SYS_CHROOT, SYS_ADMIN]          # needed for procfs mount + chroot
cap_drop: [NET_RAW, MKNOD, ...]             # defence-in-depth
security_opt:
  - no-new-privileges:true
  - seccomp=<workDir>/seccomp-profile.json  # custom deny-by-default
  - apparmor:unconfined                     ← NOTE: weakened

Seccomp profile (containers/agent/seccomp-profile.json):

defaultAction: SCMP_ACT_ERRNO              # deny-by-default ✓
architectures: x86_64, x86, aarch64
Explicitly blocked: ptrace, process_vm_readv/writev, kexec, pivot_root, umount, reboot, init_module, ...

Strengths:

• NET_ADMIN never granted to the agent container — given only to the ephemeral awf-iptables-init init container, which exits before user code runs (src/services/agent-service.ts:309-312)
• no-new-privileges:true prevents setuid binaries from re-acquiring capabilities
• ptrace, process_vm_readv, process_vm_writev explicitly blocked — prevents memory scraping of Squid/API-proxy processes
• hidepid=2 on /host/proc prevents reading PID 1's environ (critical for credential isolation)
• capsh --drop=cap_sys_chroot,cap_sys_admin called before user code runs (entrypoint.sh:1320,1355)

Weaknesses:

1. apparmor:unconfined (src/services/agent-service.ts:92): AppArmor is explicitly disabled to allow the mount syscall (procfs setup). Without AppArmor, capabilities become the sole MAC boundary. The comment says SYS_ADMIN is dropped via capsh before user code — this is verified correct — but unconfined AppArmor is a CIS Docker Benchmark finding (DIC-5.2).

2. SYS_ADMIN granted during entrypoint — while dropped before user code, the window between container start and capsh --drop allows the entrypoint itself to exploit SYS_ADMIN. The entrypoint is trusted code, but any injection into it (env vars, config files) during that window would be privileged.

3. Log directories chmod 0777 fallback (src/log-directory-setup.ts:90,106,115,127): When chown fails, directories are made world-writable. An agent that writes symlinks into a 0777 log directory could redirect log file writes. This is partially mitigated because the log paths are in the workdir (under /tmp/awf-<ts>/), which is only accessible on the host.

---

Domain Validation Assessment

Evidence (src/domain-validation.ts, src/domain-patterns.ts):

Validated controls:

• SQUID_DANGEROUS_CHARS = /[\s\0"' ;#]/ blocks whitespace, null, quotes, semicolon, backtick, hash
• DOMAIN_DANGEROUS_CHARS adds backslash for domain names (not URL patterns)
• Wildcard * converted via wildcardToRegex() using [a-zA-Z0-9.-]* character class — prevents ReDoS
• Over-broad patterns (*, *.*, patterns composed only of * and .) explicitly rejected
• API proxy IP validated via strict IPv4 regex before interpolation into Squid config

Remaining gap:

The --allow-urls path (for url_regex ACL) allows backslash in URL patterns (domain-validation.ts:21). While backslash is legitimate in URL regex, a crafted pattern like \n (newline) could split Squid config lines. The SQUID_DANGEROUS_CHARS check covers \s (which includes \n) for the url_regex path, so this appears mitigated — but it deserves explicit test coverage with multi-line URL patterns.

---

Input Validation Assessment

CLI proxy URL injection (containers/agent/entrypoint.sh:179–181):

CLI_PROXY_HOST=$(echo "$AWF_CLI_PROXY_URL" | sed -E 's|^https?://([^:/]+).*|\1|')
CLI_PROXY_PORT=$(echo "$AWF_CLI_PROXY_URL" | sed -E 's|^https?://[^:]+:([0-9]+).*|\1|')
if timeout 5 bash -c "cat < /dev/null > /dev/tcp/${CLI_PROXY_HOST}/${CLI_PROXY_PORT}" 2>/dev/null

AWF_CLI_PROXY_URL is generated internally by src/services/cli-proxy-service.ts:106 as (redacted) where the IP is hardcoded from the Docker Compose network (172.30.0.50). The TypeScript source validates this IP (CLI_PROXY_PORT = 11000). **However**, the bash script does not re-validate the extracted CLI_PROXY_HOST/CLI_PROXY_PORTbefore using them unquoted in/dev/tcp/expansion. If a crafted env var (e.g. from a container image or an attack on the compose environment) were injected, the unquoted expansion${CLI_PROXY_HOST}could cause a bash word-split or path traversal in the/dev/tcp/HOST/PORT` special file path.

Risk: Low, because AWF_CLI_PROXY_URL is set programmatically, not from user input. But the bash lacks a defensive guard.

Squid config injection: Well-guarded. Domain names pass through validateDomainOrPattern() before being interpolated into Squid config ACL lines. The formatDomainForSquid() function prepends a . but does not perform additional escaping — relying on the character allowlist validation upstream.

Command execution (src/container-stop.ts:43):

['exec', '--user', 'root', SQUID_CONTAINER_NAME, 'chmod', '-R', 'a+rX', '/var/log/squid']

SQUID_CONTAINER_NAME is a hardcoded constant — no injection risk. All execa() calls pass arguments as arrays (not shell strings), preventing shell injection.

---

⚠️ Threat Model (STRIDE)

STRIDE Category	Threat	Evidence	Likelihood	Impact	Severity
Spoofing	Agent claims to be Squid by binding 172.30.0.10	Squid IP is fixed; agent IP is separate (172.30.0.20)	Very Low	Medium	Low
Spoofing	Malicious container image replaces GHCR image	--image-tag latest is mutable; no mandatory digest pinning	Medium	High	Medium
Tampering	Agent modifies iptables after init container exits	NET_ADMIN never granted to agent container	Very Low	Critical	Low
Tampering	Agent tampers with Squid config via env var race	Config passed as base64 env var decoded once at startup	Very Low	High	Low
Tampering	Agent writes to 0777 log directory (symlink attack)	chmod 0777 fallback in log-directory-setup.ts:90	Low	Low	Low
Repudiation	Agent denies having made a network request	Squid access.log + audit.jsonl record all requests	Very Low	Low	Low
Information Disclosure	Credential leakage via /proc/1/environ race	hidepid=2 + one-shot-token mitigate, not eliminate	Low	Critical	Medium
Information Disclosure	Credential leakage via DNS TXT exfiltration	DNS resolver is restricted but payload not inspected	Medium	High	Medium
Information Disclosure	Credential leakage via mutable busybox:latest pull	DinD probe image (src/dind-probe.ts:35) unpinned	Low	Medium	Low
Information Disclosure	SSL private key on disk (non-tmpfs fallback)	ssl-bump.ts logs "stored on disk" when tmpfs fails	Low	Medium	Low
DoS	Agent exhausts memory/CPU, kills runner	mem_limit: 6g set, no CPU cap	Low	Medium	Low
DoS	Agent floods Squid log with requests	No rate-limiting on Squid log writes	Low	Low	Low
Elevation of Privilege	Agent exploits unconfined AppArmor + SYS_ADMIN window	AppArmor disabled; SYS_ADMIN dropped before user code	Low	Critical	Medium
Elevation of Privilege	Agent uses ptrace on sibling container	ptrace blocked by seccomp profile	Very Low	Critical	Low
Elevation of Privilege	Agent calls pivot_root or umount to escape chroot	Both blocked by seccomp	Very Low	Critical	Low

---

🎯 Attack Surface Map

Attack Surface	Entry Point	Current Protections	Risk Level
HTTP/HTTPS egress	Port 80/443 outbound from agent	NAT DNAT → Squid; domain ACL; DLP URL scanning	Low
DNS exfiltration	UDP/TCP port 53 outbound	Resolver restricted to 8.8.8.8 (or user-configured); no payload inspection	Medium
CLI proxy URL env var	AWF_CLI_PROXY_URL in container env	Set programmatically; unquoted in bash /dev/tcp path	Low
Domain allowlist injection	--allow-domains CLI argument	validateDomainOrPattern() blocks dangerous chars	Low
Container image supply chain	GHCR latest tag (mutable)	Digest pinning optional (--image-tag tag,img=sha256:...)	Medium
Credential files	Host ~/.docker/config.json, ~/.ssh/id_*, etc.	14 files hidden via /dev/null bind mounts	Low
procfs credential race	/host/proc/1/environ	hidepid=2; token unset after 1s; one-shot-token LD_PRELOAD	Medium
SYS_ADMIN during entrypoint	Entrypoint script (runs as root with SYS_ADMIN)	Dropped via capsh --drop before user code	Low
AppArmor bypass	apparmor:unconfined on agent	Seccomp + capability drop compensate; no user-code mount	Medium
Squid config YAML injection	generateSquidConfig() interpolation	Upstream validation; strict character allowlist	Low
Log directory symlink attack	0777 fallback on log dirs	Logs in workdir (world-readable only on host, not container)	Low
UDP protocol bypass	Non-HTTP UDP (QUIC, NTP)	Blocked by iptables filter; logged to kernel dmesg	Low

---

📋 Evidence Collection

Network: iptables key rules (setup-iptables.sh)

Line 192: iptables -t nat -A OUTPUT -o lo -j RETURN
Line 193: iptables -t nat -A OUTPUT -d 127.0.0.0/8 -j RETURN
Line 207: iptables -t nat -A OUTPUT -d "$AGENT_IP" -j RETURN       # self-bypass
Line 213: iptables -t nat -A OUTPUT -d "$SQUID_IP" -j RETURN       # Squid bypass
Line 133: sysctl -w net.ipv6.conf.all.disable_ipv6=1               # IPv6 suppress
DNAT rules for port 80/443 → Squid:3128 (defense-in-depth)

Container: capabilities (src/services/agent-service.ts)

cap_add: ['SYS_CHROOT', 'SYS_ADMIN'],   // dropped before user code
cap_drop: ['NET_RAW', 'MKNOD', ...],
security_opt: [
  'no-new-privileges:true',
  'seccomp=<workDir>/seccomp-profile.json',
  'apparmor:unconfined',                 // weakened for procfs mount
]

iptables-init container gets cap_add: ['NET_ADMIN', 'NET_RAW'] and cap_drop: ['ALL'] separately, never grants to agent.

Domain injection protection (src/domain-validation.ts)

const SQUID_DANGEROUS_CHARS = /[\s\0"'`;#]/;
// Domain-specific additionally blocks backslash:
const DOMAIN_DANGEROUS_CHARS = /[\s\0"'`;#\\]/;
// Wildcard → safe character class (anti-ReDoS):
const DOMAIN_CHAR_PATTERN = '[a-zA-Z0-9.-]*';
// Over-broad patterns rejected: *, *.*, [*/.]+

Credential hiding (src/services/agent-volumes/credential-hiding.ts)

14 credential files shadowed via /dev/null:${path}:ro mounts:
.docker/config.json, .npmrc, .cargo/credentials, .composer/auth.json, .config/gh/hosts.yml, .ssh/id_{rsa,ed25519,ecdsa,dsa}, .aws/{credentials,config}, .kube/config, .azure/credentials, .config/gcloud/credentials.db

Both plain-home and /host${home} chroot paths are covered.

Seccomp profile (containers/agent/seccomp-profile.json)

defaultAction: SCMP_ACT_ERRNO  (deny by default)
Architectures: SCMP_ARCH_X86_64, SCMP_ARCH_X86, SCMP_ARCH_AARCH64
Explicit DENY (SCMP_ACT_ERRNO):
  - ptrace, process_vm_readv, process_vm_writev
  - kexec_load, kexec_file_load, reboot, init_module, finit_module, delete_module
  - pivot_root, umount, umount2
  - acct, swapon, swapoff, syslog, add_key, request_key, keyctl
  - name_to_handle_at, open_by_handle_at (container escape syscalls)

Token protection mechanism (containers/agent/entrypoint.sh:452-495)

run_agent_with_token_protection() {
  "$@" &           # launch agent in background
  AGENT_PID=$!
  sleep 0.1 x10    # wait up to 1s for token caching via LD_PRELOAD
  unset_sensitive_tokens  # clear from parent PID 1 environ
  wait $AGENT_PID  # collect exit code
}
# Tokens unset: ANTHROPIC_API_KEY + others (line 430)
# hidepid=2 prevents reading /proc/1/environ during the race window
# one-shot-token.so LD_PRELOAD caches token value once on first getenv()

---

✅ Recommendations

🔴 Critical

No critical (immediate RCE / container escape) findings identified.

🟠 High

H-1: Harden AppArmor profile instead of disabling it

• Finding: apparmor:unconfined (src/services/agent-service.ts:92) eliminates AppArmor MAC protection to allow the mount syscall during entrypoint setup.
• Recommendation: Create a custom AppArmor profile that allows mount only in the entrypoint phase (before user code), or evaluate whether unconfined can be scoped to the entrypoint process only. The Docker CIS Benchmark (DIC-5.2) requires AppArmor profiles to be applied.
• Effort: Medium (requires authoring and testing a custom AppArmor policy).

H-2: Pin DinD probe image to a digest

• Finding: PROBE_IMAGE = 'busybox:latest' (src/dind-probe.ts:35) is pulled from Docker Hub without a digest. A compromised or man-in-the-middle delivery of busybox:latest could execute arbitrary code in the probe context.
• Recommendation: Pin to a known digest, e.g. busybox:1.36@sha256:<digest>.
• Effort: Low.

🟡 Medium

M-1: Validate and quote CLI_PROXY_HOST / CLI_PROXY_PORT in bash

• Finding: containers/agent/entrypoint.sh:181 expands ${CLI_PROXY_HOST} and ${CLI_PROXY_PORT} unquoted inside a bash -c string in /dev/tcp/${CLI_PROXY_HOST}/${CLI_PROXY_PORT}. While the values are set programmatically, defence-in-depth calls for explicit format validation.
• Recommendation: Add a regex guard:

  [[ "$CLI_PROXY_HOST" =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]] || { echo "Invalid host"; exit 1; }
  [[ "$CLI_PROXY_PORT" =~ ^[0-9]+$ ]] || { echo "Invalid port"; exit 1; }

• Effort: Very low.

M-2: DNS payload exfiltration via TXT records

• Finding: DNS queries flow to 8.8.8.8 (default) without content inspection. A malicious agent can exfiltrate data via DNS TXT lookups to attacker-controlled subdomains within an allowed domain (e.g. data.allowed-domain.com).
• Recommendation: Enable --dns-over-https by default, or add rpz (response policy zone) filtering to Squid/DNS. Consider log-and-alert for anomalously high DNS query rates.
• Effort: Medium.

M-3: Investigate log directory 0777 fallback

• Finding: When chown fails, log directories are set to chmod 0777 (src/log-directory-setup.ts:90,106,115,127). This allows the agent to create symlinks or hardlinks in the log directory, potentially redirecting log writes.
• Recommendation: Prefer a more restrictive fallback (e.g. 0755 + group-writable 0775) rather than world-writable. Log correctly only when the expected UID owns the directory.
• Effort: Low.

🟢 Low

L-1: Enforce image digest pinning in CI/production use

• Provide a documented workflow for pinning container images to SHA256 digests using --image-tag <tag>,squid=sha256:<digest>,agent=sha256:<digest>. The digest support already exists (src/image-tag.ts); it should be a documented best practice in the README.
• Effort: Very low (documentation only).

L-2: Add explicit test for multi-line URL regex patterns

• The --allow-urls path exempts backslash from the dangerous-char check (intentional for regex escaping), but there is no test confirming that \n/\r in URL patterns is blocked by the \s check in SQUID_DANGEROUS_CHARS.
• Effort: Very low (add 2–3 test cases).

L-3: Rate-limit iptables LOG rules in kernel

• setup-iptables.sh LOG rules have no --limit option. A high-traffic agent can spam the kernel log ring buffer with [FW_BLOCKED_UDP] entries, potentially overwriting other system log messages (minor DoS on observability).
• Recommendation: Add --limit 10/min --limit-burst 20 to the LOG rules.
• Effort: Very low.

L-4: Consider CPU quotas

• The compose generator sets mem_limit: 6g but no cpu_quota. A runaway agent can pin all CPU cores, starving the runner.
• Effort: Low.

---

📈 Security Metrics

Metric	Value
Lines of security-critical code analyzed	~58,254 (TypeScript + shell)
Source files reviewed	189
Attack surfaces enumerated	12
STRIDE threats identified	14
Critical findings	0
High findings	2
Medium findings	3
Low findings	4
Credential files hidden via /dev/null	14
Seccomp deny rules	26+ dangerous syscalls
Firewall enforcement layers	3 (host iptables, container NAT, L7 Squid)

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by Daily Security Review and Threat Modeling · 112.3 AIC · ⊞ 6.5K · ◷

• expires on Jul 16, 2026, 8:31 AM UTC

[github-actions[bot]]

🔮 The ancient spirits stir. The smoke-test agent passed through, and the repository signs remain aligned.

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

• awmgmcpg
• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

[github-actions[bot]]

🔮 The ancient spirits stir: the smoke test agent passed through the firewall, read the runes, and left no lingering warnings.

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

• awmgmcpg
• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

[github-actions[bot]]

🔮 The ancient spirits stir; the smoke test agent has passed through this forum and leaves this omen in its wake.

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

• awmgmcpg
• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

[github-actions[bot]]

🔮 The ancient spirits stir: the smoke test agent has passed through this discussion, and the omens are recorded.

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

• awmgmcpg
• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}