[Security Review] Daily Security Review - 2026-10-02

[github-actions[bot]]

📊 Executive Summary

Review of the gh-aw-firewall network, container, and domain-pattern code. No new exploitable vulnerabilities were found. The defense-in-depth layers (Squid ACL, iptables, seccomp, capability drop) are consistent with the documented design. Limits: npm audit could not reach the advisory endpoint (self-signed certificate error), so dependency CVEs are unverified. This run was a targeted review; it did not read every file in full.

🔍 Findings from Firewall Escape Test

/tmp/gh-aw/escape-test-summary.txt (200 lines) holds only conclusion-job logs from a "Secret Digger (Copilot)" run on branch feat/security-mode-strict.

• The agent refused the task and emitted a noop.
• No escape attempts were executed, so there is no escape evidence either way.
• The detection job reported threat_detected (warning) and opened tracking issue [aw] Detection Runs #6205. This is worth triaging separately.

🛡️ Architecture Security Analysis

Network. containers/agent/setup-iptables.sh:480-482 ends the OUTPUT chain with iptables -A OUTPUT -p tcp -j DROP and -p udp -j DROP. Squid is the only allowed egress, and DNS is limited to the configured servers.

Container (src/services/agent-service.ts:56-81)

• The agent gets cap_add: SYS_CHROOT, SYS_ADMIN, which are dropped via capsh before user code runs.
• cap_drop covers NET_RAW, SYS_PTRACE, SYS_MODULE, SYS_RAWIO and MKNOD.
• no-new-privileges:true is set, and the seccomp profile is defaultAction: SCMP_ACT_ERRNO (deny by default).
• NET_ADMIN is only granted to the separate iptables-init container (agent-service.ts:351-352, cap_drop: ALL).
• Limits: pids_limit defaults to 1000 and mem_limit to 6g.
• apparmor:unconfined (agent-service.ts:80) is a CIS Docker 5.1 deviation. The comment justifies it by the SYS_ADMIN drop, which makes it a residual risk if capsh ever failed.

Domain validation (src/domain-patterns.ts:72-124)

• wildcardToRegex escapes regex metacharacters and anchors with ^...$.
• * becomes [a-zA-Z0-9.-]*, which avoids ReDoS.
• Note that * can span dots, so *.example.com also matches a.b.example.com. This looks intentional.

Input and injection. Docker Compose YAML is generated through js-yaml, not string concatenation. Squid config is passed as base64 in an env var.

⚠️ Threat Model (STRIDE)

Category	Threat	Evidence	Likelihood / Impact
Spoofing	Agent calls the API-proxy sidecar without auth	CLAUDE.md design; container-network only	Low / Medium
Tampering	Agent edits the workspace or /tmp (rw mounts)	Selective bind mounts	Medium / Low
Repudiation	Squid and iptables logs are preserved	firewall_detailed logformat	Low / Low
Info disclosure	Credentials hidden through the api-proxy, /dev/null overlays, and procfs hidepid=2	entrypoint.sh, agent-service.ts	Low / High
DoS	Resource limits set (pids, memory)	agent-service.ts:92-100	Low / Low
Elevation	SYS_ADMIN is held during startup and AppArmor is unconfined	agent-service.ts:64-81	Low / High

🎯 Attack Surface Map

Surface	Entry point	Protections	Risk
Network egress	setup-iptables.sh, Squid	DROP default, domain ACL	Low
Container runtime	agent-service.ts	seccomp, no-new-privileges, cap drop	Medium
Domain parsing	domain-patterns.ts	Escaping and anchoring	Low
CLI input	src/cli.ts	commander; compose built via YAML	Low
API-proxy sidecar	172.30.0.30:10000-10003	Network isolation	Low

📋 Evidence Collection

Commands run

• grep -rn "cap_drop|cap_add|NET_ADMIN..." src/ showed capability use in agent-service.ts and capability-filter.ts.
• sed -n 50,100p src/services/agent-service.ts showed the security options above.
• grep -n "defaultAction" containers/agent/seccomp-profile.json returned SCMP_ACT_ERRNO.
• grep -n "DROP" containers/agent/setup-iptables.sh showed the final DROP rules (lines 480 and 482).
• npm audit failed: self-signed certificate.

✅ Recommendations

• Critical: none.
• High: none.
• Medium:
  • Run npm audit in CI, where the advisory endpoint is reachable, and record the result.
  • Consider a narrower AppArmor profile that allows only procfs mount, instead of unconfined.
• Low:
  • Document that wildcard * spans multiple labels.
  • Make the escape-test summary fetch emit actual test results. The current file has only conclusion-job noise, so this review had no escape evidence.
  • Triage detection issue [aw] Detection Runs #6205.

📈 Security Metrics

• Files examined: about 6, with setup-iptables.sh at 540 lines and domain-patterns.ts at 137.
• Attack surfaces identified: 5.
• STRIDE coverage: 6/6 categories.
• Confirmed vulnerabilities: 0.

Generated by Daily Security Review and Threat Modeling · copilot · auto · 22.1 AIC · ⊞ 10.8K · ◷

• expires on Oct 9, 2026, 12:40 PM UTC

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-10-09T12:40:33.563Z.

Closed by Workflow