[Security Review] 🔒 Daily Security Review – 2026-07-11

[github-actions[bot]]

📊 Executive Summary

This is a daily security review of the gh-aw-firewall repository as of 2026-07-11. The codebase implements a multi-layered defence: domain-allowlist enforcement via Squid proxy, iptables DNAT/FILTER rules, container capability restrictions, seccomp profiles, chroot isolation, and UID/GID remapping. The overall security posture is strong, with several deliberate defence-in-depth layers. No critical vulnerabilities were found. Several medium-severity hardening gaps and design-level risks are identified below.

Key metrics:

• 411 TypeScript source files (~26 k lines) analysed
• 1,381-line entrypoint.sh and 536-line setup-iptables.sh reviewed
• 7 attack surfaces enumerated
• 0 critical findings, 0 high findings, 3 medium findings, 5 low/informational findings

---

🔍 Findings from Firewall Escape Test

The pre-fetched escape test summary (/tmp/gh-aw/escape-test-summary.txt) was present but empty at the time of this review. No complementary escape-test data was available to cross-reference. Findings below are based solely on static code analysis.

---

🛡️ Architecture Security Analysis

Network Security Assessment

Two-layer enforcement (host + container):

1. Host-level (src/host-iptables-rules.ts): A dedicated FW_WRAPPER iptables chain is inserted into DOCKER-USER to filter traffic that originates from the AWF network bridge. Squid and DoH proxy sources are explicitly allowed; DNS is restricted to pre-validated nameservers; dangerous ports (22, 25, 445, 1433, 1521, 3306, 3389, 5432, 6379, 27017–28017) are blocked.

2. Container-level (containers/agent/setup-iptables.sh, lines 405–419): All port-80 and port-443 TCP egress is DNAT'd to Squid at 172.30.0.10:3128. The iptables-init init container runs before the agent command starts and signals readiness via /tmp/awf-init/ready.

Positive findings:

• IPv6 is disabled inside the agent container via sysctl net.ipv6.conf.all.disable_ipv6=1 (setup-iptables.sh line ~130), preventing IPv6 proxy bypass.
• Docker's embedded DNS DNAT rules are preserved (setup-iptables.sh line ~186), preventing DNS resolution breakage.
• Squid is in explicit forward-proxy mode (not transparent intercept). HTTPS uses CONNECT tunnelling; SSL Bump is opt-in.
• forwarded_for delete and via off are set in the generated Squid config (src/squid/config-generator.ts lines 148–149), preventing client IP leakage.

Gap – proxy-unaware HTTPS tools (medium):
When a tool does not honour HTTPS_PROXY, its TLS ClientHello is DNAT'd to Squid port 3128, which is listening in forward-proxy mode (not ssl-bump intercept mode by default). Squid will reject the raw TLS with a connection error rather than a clean 403. The traffic is still blocked, but the error surface is different and could cause confusing agent behaviour. This is a known, accepted trade-off documented in AGENTS.md.

Gap – AppArmor unconfined (medium):
agent-service.ts line 93:

'apparmor:unconfined',

AppArmor is set to unconfined on the agent container because Docker's default AppArmor profile blocks mount (needed for procfs at /host/proc). While SYS_ADMIN is dropped via capsh before user code runs (entrypoint.sh line ~400), the container runs without AppArmor confinement for the initial entrypoint phase where SYS_ADMIN is still held. This is a hardening gap.

---

Container Security Assessment

Capability model (src/services/agent-service.ts):

cap_add:  [SYS_CHROOT, SYS_ADMIN]   # needed for chroot + procfs mount
cap_drop: [NET_RAW, SYS_PTRACE, SYS_MODULE, SYS_RAWIO, MKNOD]

SYS_CHROOT and SYS_ADMIN are explicitly dropped via capsh --drop=cap_sys_chroot,cap_sys_admin before user code executes (entrypoint.sh lines ~399–403 and ~1320). This is correct practice.

NET_ADMIN is never granted to the agent — only to the separate awf-iptables-init init container that shares the network namespace.

UID/GID remapping (containers/agent/entrypoint.sh lines 12–61):

• AWF_USER_UID and AWF_USER_GID are validated to be numeric and non-zero (non-root) before use.
• UID 0 (root) is explicitly rejected.

Seccomp: A custom seccomp profile is written to workDir/seccomp-profile.json and applied per container. no-new-privileges:true is also set.

WorkDir tmpfs overlay: The Docker Compose config creates a tmpfs over workDir inside the container so the agent cannot read docker-compose.yml (which contains tokens/API keys in plaintext).

Gap – SYS_ADMIN window (low):
Between container start and the capsh --drop call, SYS_ADMIN is held with AppArmor unconfined. If entrypoint.sh crashes or is replaced via a bind-mount race, the capability could be misused. The risk is low because the bind mounts are prepared before container start and the entrypoint is fixed in the image.

---

Domain Validation Assessment

Injection prevention (src/domain-validation.ts):

Five-stage validation pipeline:

1. Empty check
2. Dangerous-char check: /[\s\0"'`;#\]/ — prevents Squid config injection via whitespace, comment injection (#`), null bytes, and backslash-regex injection.
3. Over-broad wildcard rejection: *, *.*, patterns of only */.
4. Double-dot rejection
5. Lone-dot and excess-wildcard-segment rejection

Wildcard-to-regex (src/domain-patterns.ts):
wildcardToRegex() converts * to [a-zA-Z0-9.-]* (explicitly avoiding .* to prevent ReDoS). All regex metacharacters are escaped. The result is anchored: ^...$.

Gap – subdomain bypass via trailing label (low/informational):
The plain-domain ACL uses Squid dstdomain .github.com, which matches github.com and all subdomains. A domain like evilgithub.com does NOT match (Squid's dstdomain is suffix-matched on label boundaries). This is correct behaviour, but the behaviour depends on Squid's implementation. No code-level vulnerability found.

---

Input Validation Assessment

CLI input (src/cli-options.ts, src/option-parsers.ts):

• Port specifications are validated by parseValidPortSpecs() in src/host-iptables-validation.ts and re-validated with is_valid_port_spec() in setup-iptables.sh as defence-in-depth.
• UID/GID values are restricted to non-zero numerics.

Shell command construction:
The agent command is passed to capsh via a shell script file (SCRIPT_FILE=/tmp/awf-cmd-$$.sh, entrypoint.sh line ~1232), not directly interpolated into a shell string. This avoids most shell-injection risks.

execa usage (src/host-iptables-rules.ts):
All execa calls pass arguments as arrays, not shell strings — correct practice that prevents shell injection.

Secret redaction (src/redact-secrets.ts):
Patterns cover Bearer tokens, GitHub PAT prefixes (ghp_, gho_, ghu_, ghs_), and TOKEN/SECRET/PASSWORD/KEY/AUTH env-var patterns. Redaction is applied to logged command strings.

---

⚠️ Threat Model (STRIDE)

Category	Threat	Likelihood	Impact	Mitigation
Spoofing	Agent forges source IP to bypass Squid ACLs	Low	High	Fixed IP topology (172.30.0.0/24); Squid src ACL; agent has no NET_ADMIN
Spoofing	Agent calls API proxy without credentials to impersonate legitimate request	Low	Medium	API proxy accepts unauthenticated calls by design (trust boundary is network isolation, not auth)
Tampering	Agent modifies generated squid.conf before Squid reads it	Very Low	Critical	WorkDir tmpfs overlay prevents agent from reading/writing workDir
Tampering	Malicious domain in --allow-domains injects Squid config directives	Low	High	validateDomainOrPattern() in src/domain-validation.ts blocks all injection chars
Tampering	Agent modifies /etc/resolv.conf to use attacker-controlled DNS	Low	Medium	entrypoint.sh overwrites /etc/resolv.conf; iptables blocks non-whitelisted DNS servers
Repudiation	Agent denies having made a network request	Low	Medium	Squid access.log + audit.jsonl with timestamps; iptables LOG rules
Information Disclosure	Agent reads docker-compose.yml to extract API keys	Low	Critical	tmpfs overlay on workDir (src/services/agent-service.ts lines 44–56)
Information Disclosure	Agent reads other process /proc/[pid]/environ	Low	High	procfs mounted with hidepid=2 (entrypoint.sh)
Information Disclosure	Client IP leaked to upstream via X-Forwarded-For	Low	Low	forwarded_for delete; via off in Squid config
Denial of Service	Agent spawns unlimited processes	Medium	Medium	pids_limit: 1000 in agent service config
Denial of Service	Agent exhausts host memory	Medium	Medium	mem_limit: 6g; memswap_limit configured
Elevation of Privilege	Agent re-acquires SYS_ADMIN after capsh drop	Very Low	Critical	no-new-privileges:true; bounding set cleared by capsh
Elevation of Privilege	Agent escapes chroot via open file descriptor	Very Low	High	SYS_CHROOT dropped before user code; chroot is to /host (read-only system dirs)
Elevation of Privilege	IPv6 egress bypasses IPv4 iptables rules	Low	High	IPv6 disabled via sysctl inside container

---

🎯 Attack Surface Map

Surface	Entry Point	Current Protections	Risk
HTTP/HTTPS egress	Agent → port 80/443	DNAT to Squid; domain allowlist ACL	Low
HTTPS (proxy-unaware tools)	Agent raw TLS → DNAT → Squid	Squid rejects raw TLS with conn error; still blocked	Low
Domain allowlist input	--allow-domains CLI arg	5-stage validation in validateDomainOrPattern()	Low
Wildcard domain patterns	*.example.com in --allow-domains	ReDoS-safe regex; over-broad rejection	Low
Container filesystem	/tmp, workspace bind mounts	WorkDir tmpfs; /etc/shadow excluded; home dir whitelist	Low-Medium
UID/GID remapping	AWF_USER_UID/GID env vars	Numeric validation; root (0) rejected	Low
API key exfiltration via URL	Agent encodes secret in URL query	DLP Squid url_regex patterns (opt-in --enable-dlp)	Medium (DLP opt-in)
DNS-based exfiltration	Agent uses non-whitelisted DNS	Host iptables restricts DNS to whitelisted servers	Low
Dangerous port access	SSH/SMTP/DB ports	Blocked in both host iptables and container iptables	Low
AppArmor unconfined window	Entrypoint holds SYS_ADMIN pre-capsh	SYS_ADMIN dropped via capsh before user code; no AppArmor	Medium

---

📋 Evidence Collection

Network enforcement — DNAT rules (setup-iptables.sh lines 405–419)

grep -n "DNAT\|REDIRECT" /tmp/copilot-tool-output-1783754933372-yjp5hp.txt
# 133: DNAT rules are IPv4-based (IPv6 disabled)
# 405: iptables -t nat -A OUTPUT -p tcp --dport 80  -j DNAT --to-destination "${SQUID_IP}:${SQUID_PORT}"
# 406: iptables -t nat -A OUTPUT -p tcp --dport 443 -j DNAT --to-destination "${SQUID_IP}:${SQUID_PORT}"

Domain injection prevention (src/domain-validation.ts)

// Line 26 — dangerous characters blocked:
export const SQUID_DANGEROUS_CHARS = /[\s\0"'`;#]/;

// Domain-specific check also blocks backslash:
const DOMAIN_DANGEROUS_CHARS = /[\s\0"'`;#\\]/;

WorkDir tmpfs overlay (src/services/agent-service.ts lines 44–56)

tmpfs: [
  '/tmp/gh-aw/mcp-logs:rw,noexec,nosuid,size=1m',
  '/host/tmp/gh-aw/mcp-logs:rw,noexec,nosuid,size=1m',
  `${config.workDir}:rw,noexec,nosuid,size=1m`,
  `/host${config.workDir}:rw,noexec,nosuid,size=1m`,
  '/host/dev/shm:rw,noexec,nosuid,nodev,size=65536k',
],

Capability management (src/services/agent-service.ts lines 69–97)

cap_add: ['SYS_CHROOT', 'SYS_ADMIN'],
cap_drop: ['NET_RAW', 'SYS_PTRACE', 'SYS_MODULE', 'SYS_RAWIO', 'MKNOD'],
security_opt: [
  'no-new-privileges:true',
  `seccomp=${config.workDir}/seccomp-profile.json`,
  'apparmor:unconfined',
],

IPv6 disable (setup-iptables.sh ~line 130)

sysctl -w net.ipv6.conf.all.disable_ipv6=1
sysctl -w net.ipv6.conf.default.disable_ipv6=1

Squid header privacy (src/squid/config-generator.ts lines 148–149)

forwarded_for delete
via off

---

✅ Recommendations

Medium Priority

1. Harden AppArmor for entrypoint phase — Currently apparmor:unconfined is required because Docker's default AppArmor profile blocks mount. Consider writing a custom AppArmor profile that allows only the specific mounts performed in entrypoint.sh (procfs at /host/proc) and blocks all other mount targets. This would eliminate the unconfined window while SYS_ADMIN is held.

   • File: src/services/agent-service.ts line 93

2. Make DLP opt-out rather than opt-in for known high-risk deployments — The URL-based DLP scanning (--enable-dlp) for credential patterns (GitHub tokens, OpenAI keys, Anthropic keys) is currently opt-in. For workflows where API proxy credential injection is active (--enable-api-proxy), enabling DLP by default would prevent accidental credential leakage in edge cases where a tool somehow constructs a credential-bearing URL.

   • File: src/commands/validators/config-assembly.ts (add implication rule)

3. Proxy-unaware HTTPS tools: document failure mode clearly — The TLS rejection error for proxy-unaware tools is a known, accepted trade-off, but the Squid error response (RST or handshake failure) may be misinterpreted by agents as a transient network error rather than a policy block. Consider adding an explicit deny_info Squid directive for HTTPS CONNECT rejections to return a clearer policy message where technically possible, or improve agent-side logging to detect this pattern.

Low Priority

4. Audit gosu usage alongside capsh — entrypoint.sh line ~1355 uses gosu awfuser as an alternative user-switch path. Verify that gosu does not re-acquire any capabilities that capsh --drop previously removed.

5. Add explicit net.ipv4.ip_forward guard — The DNAT rules depend on IP forwarding being enabled inside the iptables-init container's network namespace. A startup assertion that verifies net.ipv4.ip_forward=1 before writing NAT rules would make the failure mode explicit rather than silent.

6. Consider adding an AppArmor profile for Squid container — The Squid container currently uses cap_drop only (via service-security.ts). An AppArmor profile restricting Squid to only read /etc/squid/, /var/log/squid/, and network operations would add another confinement layer.

7. Verify seccomp profile covers ptrace, process_vm_readv/writev — The agent's seccomp profile is in containers/agent/seccomp-profile.json. Confirm it explicitly denies ptrace, process_vm_readv, and process_vm_writev syscalls, since SYS_PTRACE capability is dropped but the syscall itself is also a vector.

8. Rate-limit review — If --rate-limit is implemented, ensure the rate-limit state is stored in a file system path that is also covered by the workDir tmpfs overlay, preventing the agent from reading timing state.

---

📈 Security Metrics

Metric	Value
TypeScript source files analysed	411
Lines of TypeScript code	~26,170
Lines of shell scripts (entrypoint.sh + setup-iptables.sh)	~1,917
Attack surfaces enumerated	10
STRIDE threats modelled	14
Critical findings	0
High findings	0
Medium findings	3
Low/Informational findings	5
Escape test data available	❌ (empty file)

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by Daily Security Review and Threat Modeling · 66.7 AIC · ⊞ 6.5K · ◷

• expires on Jul 18, 2026, 7:33 AM UTC

[github-actions[bot]]

🔮 The ancient spirits stir... the smoke test agent was here.

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

• awmgmcpg
• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

[github-actions[bot]]

🔮 The ancient spirits stir, and the smoke test agent was here.

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

• awmgmcpg
• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}