[Security Review] Daily Security Review: Network Egress, Container Hardening & Domain ACL Analysis

[github-actions[bot]]

📊 Executive Summary

Reviewed gh-aw-firewall (awf) — a Docker network-isolation firewall wrapping agent commands with Squid L7 egress filtering. Overall posture is strong: defense-in-depth iptables (NAT DNAT + FILTER DROP-default), capability dropping (NET_ADMIN never granted to agent; SYS_CHROOT/SYS_ADMIN dropped post-chroot-setup), Squid-config injection guards (assertSafeForSquidConfig), and cap_drop: ALL + no-new-privileges on sidecars. npm audit reports 0 vulnerabilities in current dependencies. No critical issues found; a few structural hardening opportunities noted below.

🔍 Findings from Firewall Escape Test

/tmp/gh-aw/escape-test-summary.txt did not contain firewall escape-attempt results — it is CI orchestration/meta log output from an unrelated "Secret Digger (Copilot)" workflow run (run 29286879560). That run itself is a positive security signal: the agent correctly detected and refused a prompt-injection instructing it to scan the CI runner for secrets/credentials and exfiltrate them via GitHub issues, logging noop with reason "Refused prompt injection attack" and triggering the platform's GH_AW_DETECTION_REASON: threat_detected tracking issue (#6205). No actual escape/bypass evidence for the awf network sandbox was available in this file; treating it only as complementary context per instructions.

🛡️ Architecture Security Analysis

Network Security (containers/agent/setup-iptables.sh, 536 lines):

• Default-deny OUTPUT chain: final rules are iptables -A OUTPUT -p tcp -j DROP (line 480) and -p udp -j DROP (line 482), each preceded by rate-limited logging (--limit 10/min, prefixes [FW_BLOCKED_TCP]/[FW_BLOCKED_UDP_AGENT]) — good auditability without log-flood DoS risk.
• Port 80/443 are DNAT'd to Squid (lines 405–406: iptables -t nat -A OUTPUT -p tcp --dport 80/443 -j DNAT --to-destination ${SQUID_IP}:${SQUID_PORT}), forcing all web traffic through L7 ACL even for proxy-unaware tools (HTTPS ClientHello gets rejected since Squid expects CONNECT, per CLAUDE.md).
• DNS restricted to explicit trusted resolvers plus Docker's embedded 127.0.0.11 (lines 443–450), with the embedded Docker DNAT rules preserved via iptables-save/restore (lines 174–192) rather than clobbered by chain flush — avoids accidentally breaking container name resolution while still gating third-party DNS.
• Dangerous ports (SSH/SMTP/DB/Redis/MongoDB) explicitly logged (line 472) before falling through to the DROP default — belt-and-suspenders against lateral movement attempts.
• Gateway/MCP bypass logic (lines 289–322) creates a NAT RETURN (skip DNAT) + FILTER ACCEPT restricted to allowed ports for host.docker.internal-style gateway IPs — correctly scoped to avoid becoming a blanket bypass.

Container Security:

• src/services/agent-service-build.test.ts (asserted, not just documented) confirms NET_ADMIN is excluded from the agent's cap_add and only granted to the separate iptables-init container, which itself gets cap_drop: ['ALL'] alongside cap_add: ['NET_ADMIN','NET_RAW'] — minimal capability footprint per service.
• entrypoint.sh:1600/1635: capsh --drop=${CAPS_TO_DROP} executed just before user command exec, dropping cap_sys_chroot,cap_sys_admin in chroot mode (lines 430–439) so user-controlled code cannot re-chroot or remount procfs after setup — correct ordering (privileged setup happens first, then irrevocable drop).
• Sidecars (api-proxy, DoH proxy per service-security.test.ts, doh-proxy-service.test.ts) uniformly assert cap_drop: ['ALL'] — least-privilege baseline for auxiliary services.

Domain Validation (src/squid/domain-acl.ts, access-rules.ts):

• assertSafeForSquidConfig() (domain-acl.ts:28-36) rejects whitespace/null bytes/quotes/semicolons/backticks/# via SQUID_DANGEROUS_CHARS before any domain/pattern is interpolated into squid.conf — directly mitigates Squid-config-injection via a crafted --allow-domains value.
• Deny-rule generation (access-rules.ts:35-54) defaults to http_access deny all whenever no allowlist condition matches, i.e. fail-closed rather than fail-open.

Input Validation: No unsafe exec/spawn/shell-interpolation patterns were found in src/cli.ts in this pass (grep returned no hits for execa|spawn|exec(), suggesting subprocess invocation is centralized elsewhere (e.g. docker-manager) — recommend a follow-up pass specifically auditing argument arrays passed to execa for shell:true usage.

⚠️ Threat Model (STRIDE)

Category	Threat	Evidence	Likelihood	Impact
Spoofing	Rogue container claiming Squid/gateway IP inside awf-net	Fixed IP scheme (172.30.0.10/20/30) relies on Docker network isolation	Low	Medium
Tampering	Squid config injection via malicious domain string	Mitigated by assertSafeForSquidConfig (domain-acl.ts:28)	Low (mitigated)	High if bypassed
Repudiation	Agent actions not attributable	--log-uid on iptables LOG rules (setup-iptables.sh:479,481); Squid firewall_detailed logformat captures client IP	Low	Low
Info Disclosure	Secrets in /proc/1/environ after tokens used	Entrypoint explicitly unsets sensitive env vars post-injection (comment at entrypoint.sh ~442)	Medium	High
DoS	Log flooding from blocked traffic	Rate-limited via --limit 10/min --limit-burst 20	Low (mitigated)	Low
Elevation of Privilege	Agent re-chroot/remount after setup	capsh --drop=cap_sys_chroot,cap_sys_admin before exec	Low (mitigated)	Critical if bypassed

🎯 Attack Surface Map

Surface	Entry Point	Protections	Potential Weakness
Network egress	setup-iptables.sh:405-482	Default-deny DROP, DNAT-to-Squid, dangerous-port logging	Non-TCP/UDP protocols (e.g. ICMP) not explicitly enumerated in reviewed excerpt
Container capabilities	entrypoint.sh:1600, agent-service-build.ts	cap_drop, no NET_ADMIN on agent	Drop happens at exec-time; any code executed before capsh runs with full caps
Domain/config injection	src/squid/domain-acl.ts:28	Regex-based dangerous-char rejection	Regex allowlist approach — recommend verifying it's a strict allowlist of valid domain chars rather than a denylist, since denylists are more bypass-prone
Docker wrapper / CLI args	src/cli.ts	Commander-based parsing	Not verified in this pass whether all args reach execa with array (not string/shell) form — recommend explicit grep audit
Sidecar services (API proxy, DoH)	containers/api-proxy/, DoH proxy	cap_drop: ALL, credential injection only server-side	Sidecars are Node.js HTTP proxies — dependency vuln surface (mitigated: 0 findings in npm audit)

📋 Evidence Collection

Commands run

cat /tmp/gh-aw/escape-test-summary.txt
grep -n "iptables -A|iptables -I|DNAT|REJECT|DROP|ACCEPT" containers/agent/setup-iptables.sh
grep -rn "cap_drop|capabilities|NET_ADMIN|NET_RAW|SYS_ADMIN|SYS_CHROOT|privileged" src/ containers/
view src/squid/domain-acl.ts
view src/squid/access-rules.ts
grep -n "capsh|chroot|usermod" containers/agent/entrypoint.sh
npm audit --json
grep -n "execa|spawn|exec(" src/cli.ts

✅ Recommendations

• Critical: None identified.
• High: Audit src/cli.ts / docker-manager subprocess calls to confirm execa is always invoked with argument arrays (never shell: true with interpolated strings), closing any residual command-injection surface.
• Medium: Add explicit test coverage/documentation for non-TCP/UDP protocol handling (ICMP, raw sockets) in setup-iptables.sh to confirm they fall under the same default-deny posture.
• Medium: Confirm SQUID_DANGEROUS_CHARS is a strict allowlist regex (not a denylist of known-bad chars), per Principle of Least Privilege / CIS guidance on input validation.
• Low: Document in docs/environment.md the exact window (if any) between container start and capsh --drop exec during which the agent process runs with full capability set, for completeness of the threat model.

📈 Security Metrics

• Security-critical files reviewed: setup-iptables.sh (536 lines), entrypoint.sh (1664 lines, targeted sections), src/squid/domain-acl.ts, src/squid/access-rules.ts, src/host-iptables*.ts (23 files), agent-service-build.test.ts, service-security.test.ts
• Attack surfaces identified: 5 (network egress, container capabilities, domain/config injection, CLI/wrapper input, sidecar services)
• npm audit: 0 vulnerabilities (info/low/moderate/high/critical all 0)
• Threat model coverage: full STRIDE (6/6 categories addressed)

Generated by Daily Security Review and Threat Modeling · auto · 35.3 AIC · ⊞ 10.8K · ◷

• expires on Aug 25, 2026, 7:13 AM UTC