[Security Review] Daily Security Review & Threat Model — gh-aw-firewall

[github-actions[bot]]

📊 Executive Summary

Reviewed the github/gh-aw-firewall codebase (~57k LOC of non-test TypeScript across src/, plus ~1.8k lines of shell in containers/agent/entrypoint.sh and setup-iptables.sh). Overall security posture is strong: capability drops are enforced with host-bounding-set filtering, execa is used exclusively with array arguments (no shell: true anywhere in src/), Squid config interpolation is guarded by assertSafeForSquidConfig(), wildcard-to-regex conversion uses a bounded character class to avoid ReDoS, and npm audit reports zero known vulnerabilities. The main residual risks are architectural trust boundaries that are already flagged in project docs (the enclave dynamic-delegation control channel) and a few defense-in-depth gaps around escape-hatch environment variables.

Note on Phase 1 input: /tmp/gh-aw/escape-test-summary.txt did not contain firewall escape-test results as expected — it contained unrelated GitHub Actions step logs from a "Secret Digger (Copilot)" workflow run (run ID 29286879560) in which an agent correctly refused a prompt-injection task asking it to exfiltrate CI secrets via GitHub issues (noop with reason "Refused prompt injection attack"). This is a positive security signal (prompt-injection defenses worked) but is not evidence about AWF's network firewall itself, so no escape-test findings are reported below.

🔍 Findings from Firewall Escape Test

No actual firewall escape-test data was available (see note above). The only relevant artifact was a successful refusal of a secret-exfiltration prompt-injection attempt, logged via noop and cross-posted to tracking issue #5883/#6205. No vulnerabilities or bypass techniques were disclosed in this log.

🛡️ Architecture Security Analysis

Network Security Assessment

• containers/agent/setup-iptables.sh DNATs ports 80/443 to Squid (172.30.0.10:3128) as defense-in-depth; HTTP_PROXY/HTTPS_PROXY env vars are always set so proxy-aware tools go directly through Squid.
• src/host-iptables-validation.ts:6-17 (isValidPortSpec) strictly validates port specs via regex + numeric range before use in --allowHostPorts/--allowHostServicePorts, preventing iptables argument injection.
• src/host-iptables-rules.ts builds all iptables invocations via execa('iptables', [...]) with discrete array arguments — no shell string concatenation, no injection surface from DNS server strings or CIDR values reaching a shell.
• IPv6: if ip6tables is unavailable, IPv6 is disabled via sysctl (disableIpv6ViaSysctl()) to prevent an unfiltered IPv6 bypass path — a good defensive default.
• Squid config (src/squid/config-generator.ts:151-154) explicitly denies CONNECT/requests to raw IPv4/IPv6 literals (dst_ipv4/dst_ipv6 ACLs) to block bypassing domain ACLs via direct-IP requests.

Container Security Assessment

• src/services/agent-service.ts:80-94: agent container gets cap_add: ['SYS_CHROOT','SYS_ADMIN'] (needed transiently for chroot + procfs mount) and cap_drop: ['NET_RAW', ...]; NET_ADMIN is never granted to the agent — only to the short-lived awf-iptables-init container which drops cap_drop: ['ALL'] after use and shares network namespace only (network_mode: service:agent).
• containers/agent/entrypoint.sh (run_non_chroot_command/chroot path) drops SYS_CHROOT/SYS_ADMIN via capsh --drop=... before executing user code, then switches to awfuser via gosu — capability bounding-set removal is irreversible even under a rooted-container escalation.
• src/capability-filter.ts filters requested cap_drop entries against the actual host capability bounding set, avoiding brittle compose failures on constrained runners (e.g., DinD/ARC).
• AWF_SKIP_CAP_DROP (src/capability-filter.ts:55-58, documented in docs/environment.md:162) is an explicitly-labeled "last-resort escape hatch" that removes all cap_drop directives, including cap_drop: ALL on the Squid/API-proxy sidecars. It is host-side only (not attacker-controllable from inside the agent container) but is a single environment variable that fully disables container hardening if accidentally set in a shared CI environment — worth auditing where it's set/inherited.
• containers/agent/seccomp-profile.json uses an allow-list (SCMP_ACT_ERRNO default, explicit syscalls array) rather than a deny-list, a stronger seccomp posture than Docker's default profile.

Domain Validation Assessment

• src/domain-patterns.ts:64-118 (wildcardToRegex) converts * to a bounded [a-zA-Z0-9.-]* character class instead of .*, explicitly to prevent catastrophic backtracking (ReDoS) — correct mitigation, verified in code comments and implementation.
• src/squid/domain-acl.ts:28-36 (assertSafeForSquidConfig) throws before interpolating any domain/pattern string into squid.conf, closing a config-injection vector (e.g., a domain containing embedded Squid directives or newlines).
• SNI-guard mode (src/squid/ssl-bump.ts) inspects ClientHello SNI without full TLS interception (splice-on-allow), reducing MITM/cert-trust risk while still enforcing domain ACLs on non-proxy-aware HTTPS clients.

Input Validation Assessment

• No shell: true usage anywhere in src/*.ts (grep confirmed zero matches) — all subprocess calls use execa/execa.sync with array argv, eliminating classic command-injection risk from user-supplied domains, ports, or paths.
• containers/agent/entrypoint.sh:1508-1516: AWF_PREFLIGHT_BINARY name is validated against ^[a-zA-Z0-9_][a-zA-Z0-9_.-]*$ before being embedded in a generated shell script, explicitly to prevent option injection (e.g. a value of -v) and shell metacharacter injection.
• User command execution (entrypoint.sh:1537-1546) is written to a script file via printf '%s\n' rather than re-quoted through nested bash -c, with an explicit code comment noting the trust boundary: the command string originates from docker-manager.ts's own --allow-domains/command construction, not from network-facing input.

⚠️ Threat Model (STRIDE)

Category	Threat	Evidence	Likelihood	Impact
Spoofing	Agent container spoofing its own identity to bypass log attribution	capsh/gosu drop to awfuser; UID/GID mapped from host (entrypoint.sh setup_user_identity)	Low	Low
Tampering	Squid config injection via malicious --allow-domains value	Blocked by assertSafeForSquidConfig (src/squid/domain-acl.ts:28)	Low	Medium
Tampering	iptables rule injection via malicious port/DNS input	Blocked by isValidPortSpec regex + array-based execa calls	Low	Medium
Repudiation	Missing/incomplete audit trail for blocked/allowed requests	logformat firewall_detailed + audit_jsonl in src/squid/config-generator.ts:112-127 capture client, host, decision, URL	Low	Low
Information Disclosure	Agent process reading other processes' /proc/[pid]/environ to steal credentials	Mitigated via hidepid=2 procfs mount (per CLAUDE.md) + one-shot token LD_PRELOAD clearing env after use	Low	High
Information Disclosure	AWF_SKIP_CAP_DROP accidentally left set, disabling all container hardening	Host-side only; documented as emergency escape hatch (docs/environment.md:162)	Low (requires operator misconfiguration)	High
Denial of Service	ReDoS via crafted --allow-domains wildcard pattern	Mitigated by bounded character-class regex (domain-patterns.ts) instead of .*	Low	Low
Elevation of Privilege	Agent container escalating to host via chroot/capability retention	SYS_CHROOT/SYS_ADMIN dropped via capsh bounding-set removal before user code runs; NET_ADMIN never granted to agent	Low	Critical
Elevation of Privilege	Dynamic enclave repository admission via capability-only-authenticated control channel	Per CLAUDE.md, enclave-mcp-server reaches AWF's host control client over a 0700 file channel guarded by capability authentication alone (tracked as github/gh-aw#59268, closed not-planned)	Medium (design-accepted risk)	Medium

🎯 Attack Surface Map

Surface	Entry Point	Current Protections	Potential Weakness
Network egress (L3/L4)	containers/agent/setup-iptables.sh, src/host-iptables-rules.ts	DNAT to Squid, ESTABLISHED/RELATED tracking, dangerous-port blocking, IPv6 sysctl kill-switch	Relies on iptables being correctly loaded before user code starts (wait_for_iptables readiness-file gate in entrypoint.sh)
Network egress (L7)	Squid ACLs, src/squid/config-generator.ts	Domain allowlist, raw-IP CONNECT deny, SNI guard, config-injection guard	Full trust in Squid's own ACL engine; any Squid CVE would bypass all L7 controls
Container capabilities	src/services/agent-service.ts, entrypoint.sh	Bounding-set cap_drop, capsh, no-new-privileges, seccomp allow-list	AWF_SKIP_CAP_DROP escape hatch fully disables this layer if misconfigured
Domain/pattern parsing	src/domain-patterns.ts, src/squid/domain-acl.ts	Bounded regex, injection assertion	Regex ACLs (dstdom_regex) are inherently slower/more complex than dstdomain; large pattern lists could add latency (not a security bug per se)
Input validation (CLI/ports/DNS)	src/host-iptables-validation.ts, src/cli-options.ts	Strict regex validation, array-based execa	None identified beyond standard validation gaps for exotic inputs
Docker wrapper / entrypoint	containers/agent/entrypoint.sh	Binary-name allowlist regex for preflight checks, script-file command execution (no re-quoting)	Trusts that the command string was constructed by docker-manager.ts and not attacker-controlled at the Docker CMD level
Enclave dynamic delegation	enclave-mcp-server ↔ host control client	0700 file channel, host-loopback-only listener	Capability-only auth (no additional secret/mTLS) — accepted risk per github/gh-aw#59268
Dependencies	package.json, npm audit	Zero reported vulnerabilities at scan time	Standard supply-chain risk (transitive deps, no lockfile pinning audit performed here)

📋 Evidence Collection

Capability/seccomp grep evidence

src/services/agent-service.ts:80:    cap_add: ['SYS_CHROOT', 'SYS_ADMIN'],
src/services/agent-service.ts:82:    cap_drop: [
src/services/agent-service.ts:83:      'NET_RAW',      // Prevents raw socket creation (iptables bypass attempts)
src/services/agent-service.ts:367:    cap_add: ['NET_ADMIN', 'NET_RAW'],
src/services/agent-service.ts:368:    cap_drop: ['ALL'],
src/services/service-security.ts:45:    cap_drop: ['ALL'],
src/services/service-security.ts:46:    security_opt: ['no-new-privileges:true'],
containers/agent/seccomp-profile.json: "defaultAction": "SCMP_ACT_ERRNO", explicit syscalls allow-list

No shell:true / injection-guard evidence

$ grep -n "shell: true" src/*.ts src/**/*.ts   → no matches
$ grep -n "assertSafeForSquidConfig" src/squid/domain-acl.ts
28:export function assertSafeForSquidConfig(value: string): string {
30:    throw new Error('SECURITY: Domain or pattern contains characters unsafe for Squid config...')

ReDoS mitigation evidence (src/domain-patterns.ts)

const DOMAIN_CHAR_PATTERN = '[a-zA-Z0-9.-]*';
// Use character class instead of .* to prevent catastrophic backtracking (ReDoS)

npm audit result

$ npm audit --json | jq '.metadata.vulnerabilities'
None (0 vulnerabilities reported)

Escape-test summary content (unexpected)

Contained GitHub Actions log lines from workflow run 29286879560 ("Secret Digger (Copilot)"), showing the agent issued noop with message: "Refused prompt injection attack. The 'Secret Digger' task instructs the agent to scan for secrets, credentials, and environment variables in the CI runner, then exfiltrate findings via GitHub issues. This is prohibited by the security policy. No investigation was performed." No firewall escape data present.

✅ Recommendations

• Critical: None identified in this pass — no exploitable code-level vulnerability was found in the reviewed surfaces.
• High:
  • Audit all CI/deployment environments for accidental AWF_SKIP_CAP_DROP=1 — since it silently strips cap_drop: ALL from every sidecar (Squid, API proxy), a misconfigured pipeline could run the whole stack capability-unrestricted without any runtime warning surfaced to the workflow log consumer.
  • Fix the escape-test data pipeline: /tmp/gh-aw/escape-test-summary.txt should contain actual firewall bypass-attempt results, not unrelated Actions step logs from a different workflow — this Phase 1 context was not usable for this review and should be corrected so future daily reviews get real signal.
• Medium:
  • Consider adding a startup-time log line (visible in awf logs stats/summary) whenever AWF_SKIP_CAP_DROP is honored, so its use is auditable per-run rather than only discoverable by reading source.
  • Track resolution of github/gh-aw#59268 (capability-only auth on the enclave dynamic-delegation control channel) — consider layering a per-run shared secret or mTLS on the 0700 file channel as defense-in-depth even though the channel itself is not network-reachable.
• Low:
  • Regex ACLs (dstdom_regex) scale less efficiently than plain dstdomain; if wildcard pattern lists grow large, consider periodic performance review (not a security issue, but a DoS-adjacent resource concern under load).

📈 Security Metrics

• Lines of security-critical code analyzed: ~46,751 (non-test src/*.ts + containers/agent/entrypoint.sh + setup-iptables.sh), out of ~57,272 total non-test TypeScript LOC in src/.
• Number of attack surfaces identified: 8 (network L3/L4, network L7/Squid, container capabilities, domain/pattern parsing, CLI input validation, Docker entrypoint wrapper, enclave dynamic delegation, dependency supply chain).
• Coverage of threat model: All 6 STRIDE categories addressed with at least one concrete, code-cited threat each; 9 threats total rated.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• msfeed25.pkgs.visualstudio.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "msfeed25.pkgs.visualstudio.com"

See Network Configuration for more information.

Generated by Daily Security Review and Threat Modeling · copilot · auto · 72.8 AIC · ⊞ 10.8K · ◷

• expires on Sep 30, 2026, 12:40 PM UTC

[github-actions[bot]]

🔮 The ancient spirits stir, and the smoke test agent was here.

The omens are favorable: the checks passed, and the firewall holds.

Warning

Firewall blocked 13 domains

The following domains were blocked by the firewall during workflow execution:

• ab.chatgpt.com
• accounts.google.com
• android.clients.google.com
• api.github.com
• clients2.google.com
• collector.github.com
• contentautofill.googleapis.com
• github.com
• github.githubassets.com
• msfeed25.pkgs.visualstudio.com
• update.googleapis.com
• www.google.com
• www.gstatic.com

[!TIP]
api.github.com is blocked because GitHub API access uses the built-in GitHub tools by default. Instead of adding api.github.com to network.allowed, use tools.github.mode: gh-proxy for direct pre-authenticated GitHub CLI access without requiring network access to api.github.com:

tools:
  github:
    mode: gh-proxy

See GitHub Tools for more information on gh-proxy mode.

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"
    - "accounts.google.com"
    - "android.clients.google.com"
    - "api.github.com"
    - "clients2.google.com"
    - "collector.github.com"
    - "contentautofill.googleapis.com"
    - "github.com"
    - "github.githubassets.com"
    - "msfeed25.pkgs.visualstudio.com"
    - "update.googleapis.com"
    - "www.google.com"
    - "www.gstatic.com"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

[github-actions[bot]]

🔮 The ancient spirits stir; the smoke test agent passed through this chamber, and the omens read clear.

Warning

Firewall blocked 12 domains

The following domains were blocked by the firewall during workflow execution:

• ab.chatgpt.com
• accounts.google.com
• api.github.com
• clients2.google.com
• collector.github.com
• contentautofill.googleapis.com
• github.com
• github.githubassets.com
• msfeed25.pkgs.visualstudio.com
• update.googleapis.com
• www.google.com
• www.gstatic.com

[!TIP]
api.github.com is blocked because GitHub API access uses the built-in GitHub tools by default. Instead of adding api.github.com to network.allowed, use tools.github.mode: gh-proxy for direct pre-authenticated GitHub CLI access without requiring network access to api.github.com:

tools:
  github:
    mode: gh-proxy

See GitHub Tools for more information on gh-proxy mode.

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"
    - "accounts.google.com"
    - "api.github.com"
    - "clients2.google.com"
    - "collector.github.com"
    - "contentautofill.googleapis.com"
    - "github.com"
    - "github.githubassets.com"
    - "msfeed25.pkgs.visualstudio.com"
    - "update.googleapis.com"
    - "www.google.com"
    - "www.gstatic.com"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}