[Security Review] Daily Security Review — 2026-09-25

[github-actions[bot]]

📊 Executive Summary

Daily automated security review of github/gh-aw-firewall @ 6d7096d (main, clean tree). Codebase: 322 non-test TypeScript source files (~45.5k LOC across src/), 353 test files. npm audit reports 0 known dependency vulnerabilities. Overall posture is strong: layered network egress control (host iptables DOCKER-USER chain + container-scoped DNAT + Squid L7 ACL), capability-dropped/seccomp-confined agent container, strict input validation for domains/ports/IPs, and no unsafe shell/exec patterns were found. No critical or high-severity issues were identified in this pass. One previously-accepted architectural risk (capability-only auth on the dynamic-delegation control channel) is re-flagged for visibility per project docs.

🔍 Findings from Firewall Escape Test

Note: /tmp/gh-aw/escape-test-summary.txt did not contain firewall escape-test results as expected. It is a CI step-log excerpt from an unrelated workflow run, "Secret Digger (Copilot)" (run 29286879560, branch feat/security-mode-strict). That log shows the agent correctly identified the task itself as a prompt-injection / secret-exfiltration attempt ("scan for secrets, credentials, and environment variables ... exfiltrate findings via GitHub issues") and refused via noop, which the harness correctly logged as a threat_detected / warning detection and tracked in issue #6205. This is a positive security signal (prompt-injection guardrails functioning as intended) but is not the pre-fetched firewall escape-test data this workflow expected — treat as informational, not as this run's escape-test evidence.

🛡️ Architecture Security Analysis

Network Security (src/host-iptables-rules.ts, containers/agent/setup-iptables.sh)

• Host-level DOCKER-USER chain (FW_WRAPPER) enforces default-deny on all awf-net traffic regardless of container, closing the classic Docker "any container bypasses iptables via its own rules" gap.
• Explicit allow-list order: Squid source ACCEPT → conntrack ESTABLISHED/RELATED → loopback → IPv6 disabled via sysctl when ip6tables unavailable (prevents unfiltered v6 bypass, host-iptables-rules.ts:97-99) → DNS to configured upstreams only → Squid destination → optional sidecars (API proxy port-range bound, CLI proxy destination-pinned) → host-gateway access (opt-in, port-validated) → multicast/link-local REJECT → default-deny UDP/other with [FW_BLOCKED_*] LOG prefixes.
• All IP variables in setup-iptables.sh are quoted ("$SQUID_IP", "$AGENT_IP") — no shell-injection/word-splitting risk found via grep.
• --allow-host-ports / dangerous-port blocking enforced centrally in src/squid/validation.ts (validateAndSanitizeHostAccessPort), rejecting SSH/DB ports even for opt-in host access.

Container Security (src/services/agent-service.ts, containers/agent/entrypoint.sh, seccomp-profile.json)

• Agent: cap_add: [SYS_CHROOT, SYS_ADMIN] (needed for chroot + procfs mount) but both are dropped via capsh before user code runs; cap_drop removes NET_RAW, SYS_PTRACE, SYS_MODULE, SYS_RAWIO, MKNOD. NET_ADMIN is deliberately never granted to the agent (isolated to the awf-iptables-init sidecar, which itself is cap_drop: [ALL] + cap_add: [NET_ADMIN, NET_RAW] only).
• no-new-privileges:true + custom seccomp profile (default-deny SCMP_ACT_ERRNO, denies ptrace, process_vm_readv/writev, kexec_*, init_module, umount*) + apparmor:unconfined (justified: required only for mount of procfs, safe because SYS_ADMIN is dropped before user code executes).
• entrypoint.sh UID/GID remap hardened: rejects UID/GID 0, validates numeric input, checks for GID/UID collisions before usermod/groupmod.
• tmpfs overlays hide docker-compose.yml (which contains plaintext secrets) and MCP logs from the agent's chrooted view — mitigates a real secret-disclosure vector (agent-service.ts inline comments document the exact cat /tmp/awf-*/docker-compose.yml exfiltration path this closes).
• Resource limits (mem_limit, pids_limit, cpu_shares) present as DoS mitigation.

Domain Validation (src/domain-validation.ts, src/squid/domain-acl.ts)

• SQUID_DANGEROUS_CHARS = /[\s\0"';#]/plus a stricterDOMAIN_DANGEROUS_CHARS(adds`) block whitespace/null/quote/semicolon/backtick/hash/backslash injection into squid.conf; assertSafeForSquidConfig() is applied at the interpolation boundary (domain-acl.ts:24-35).
• Over-broad wildcard patterns (*, *.*, patterns of only */.) are explicitly rejected — prevents accidental "allow everything" ACL entries.
• IPv4 validation for proxy IPs uses a correct octet-bounded regex (0-255 per octet) rather than a naive \d{1,3} pattern, avoiding malformed/out-of-range IP injection.

Input Validation / Injection Risks

• No shell: true usage found anywhere in src/**/*.ts (grep -rn "shell:\s*true" → empty).
• No execa/exec invocations concatenating unsanitized user input into a shell string; commands are passed as argument arrays.
• The dynamic-delegation control client (src/enclave/delegation-control-client.ts) sends Authorization: Bearer \$\{capability} over plain http.request — appropriate for a host-loopback-only channel, and every response is strictly validated (status, content-type, bounded 128 KiB length, field-exact match against the request) before being trusted. Per CLAUDE.md, this control listener is guarded by capability authentication alone, tracked upstream as github/gh-aw#59268 (closed as not planned) — a known, accepted architectural risk rather than a new finding; re-flagged here for visibility since it's a bearer-token-only trust boundary on a privileged control path.

⚠️ Threat Model (STRIDE)

Category	Threat	Evidence	Likelihood	Impact
Spoofing	Compromised agent container spoofing Squid/DoH proxy source IP to gain unrestricted egress	host-iptables-rules.ts ACCEPT rules keyed on fixed sidecar IPs within a private Docker bridge	Low	Medium
Tampering	Malicious domain string injecting directives into squid.conf	Mitigated by SQUID_DANGEROUS_CHARS/assertSafeForSquidConfig (domain-validation.ts, domain-acl.ts)	Low (mitigated)	High if unmitigated
Repudiation	Agent actions not attributable	Squid firewall_detailed logformat + iptables --log-uid LOG rules provide traceability	Low	Low
Information Disclosure	Agent reads docker-compose.yml / MCP logs containing secrets via chroot	Mitigated via tmpfs overlays (agent-service.ts buildAgentSecurityConfig)	Low (mitigated)	High if unmitigated
Information Disclosure	Delegation control channel bearer-token-only auth if channel scope ever widens beyond loopback	delegation-control-client.ts, tracked as gh-aw#59268 (accepted risk)	Low (current scope)	Medium
Denial of Service	Agent process/memory exhaustion	mem_limit, memswap_limit, pids_limit, cpu_shares caps in agent-service.ts	Low (mitigated)	Medium
Elevation of Privilege	Container escape via retained SYS_ADMIN/SYS_CHROOT after startup	Mitigated: capsh --drop=cap_sys_chroot,cap_sys_admin before user code; seccomp blocks ptrace/init_module/umount*	Low (mitigated)	Critical if unmitigated
Elevation of Privilege	UID/GID remap to root (UID 0) at container start	Explicitly rejected in entrypoint.sh (Invalid AWF_USER_UID: cannot be 0)	Low (mitigated)	High if unmitigated

🎯 Attack Surface Map

Surface	Entry Point	Protections	Residual Weakness
Network egress	containers/agent/setup-iptables.sh, src/host-iptables-rules.ts	Default-deny DOCKER-USER chain, DNAT-to-Squid fallback, IPv6 disabled if unfilterable	None identified this pass
Domain/URL parsing	src/domain-validation.ts, src/squid/domain-acl.ts	Char blacklist + over-broad pattern rejection at interpolation boundary	None identified this pass
Container runtime	src/services/agent-service.ts, containers/agent/entrypoint.sh	cap_drop, seccomp, no-new-privileges, capsh late-drop, tmpfs secret hiding	AppArmor unconfined is a deliberate trade-off (documented, justified)
Enclave dynamic delegation	src/enclave/delegation-control-client.ts	Loopback-only listener, capability bearer, strict response validation, 128 KiB bound	Bearer-token-only auth (accepted, tracked as gh-aw#59268)
Docker wrapper / CLI	src/cli.ts, arg parsing	Argument-array execa calls (no shell interpolation found)	None identified this pass

📋 Evidence Collection

Commands run

git log --oneline -5 && git status
wc -l src/host-iptables.ts containers/agent/setup-iptables.sh src/squid-config.ts
find src -name "host-iptables*" ; find src/squid -type f
grep -rn "cap_drop|CapDrop|NET_ADMIN|NET_RAW|SYS_CHROOT|SYS_ADMIN|no-new-privileges|privileged" src/ containers/
find . -iname "seccomp*"
python3 -c "inspect seccomp-profile.json defaultAction/syscalls"
grep -rn "shell:\s*true" src/ --include="*.ts"
grep -n '\$[A-Za-z_]*' containers/agent/setup-iptables.sh | sort -u
find src/enclave -iname "*control*" -o -iname "*delegation*"
npm audit --json | jq .metadata.vulnerabilities
wc -l src/*.ts | tail -1 ; find src -name "*.ts" ! -name "*.test.ts" | wc -l

All commands executed successfully with exit code 0; no findings suppressed.

✅ Recommendations

• Critical: None identified this review cycle.
• High: None identified this review cycle.
• Medium:
  • Track and periodically re-assess github/gh-aw#59268 (dynamic-delegation control channel bearer-only auth) if the channel's exposure scope ever changes from host-loopback-only.
  • Fix the escape-test data pipeline: /tmp/gh-aw/escape-test-summary.txt should contain firewall escape-test output, not an unrelated workflow's CI step log. Verify the pre-fetch step's source query/artifact selection.
• Low:
  • Consider adding an automated npm audit --audit-level=high gate to CI (currently clean, but no enforcement was found in this pass) to catch future dependency regressions.

📈 Security Metrics

• Security-critical source files reviewed in depth: 12 (iptables rules/shared/chain, squid domain-acl/validation/config-generator, agent-service, entrypoint.sh, setup-iptables.sh, seccomp-profile.json, delegation-control-client.ts, domain-validation.ts)
• Lines of security-critical code analyzed: ~2,500+ (346-line iptables script, 346-line host-iptables-rules.ts, 218-line config-generator, entrypoint.sh, agent-service.ts security config, delegation-control-client.ts)
• Attack surfaces enumerated: 5
• STRIDE categories covered: 6/6
• npm dependency vulnerabilities: 0

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• msfeed25.pkgs.visualstudio.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "msfeed25.pkgs.visualstudio.com"

See Network Configuration for more information.

Generated by Daily Security Review and Threat Modeling · copilot · auto · 69.4 AIC · ⊞ 10.8K · ◷

• expires on Oct 2, 2026, 12:39 PM UTC

[github-actions[bot]]

🔮 The ancient spirits stir: this smoke-test agent passed through the veil. GitHub reads, file write/read, and build aligned; only the Playwright vision was absent from this realm.

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

• ab.chatgpt.com
• msfeed25.pkgs.visualstudio.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"
    - "msfeed25.pkgs.visualstudio.com"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-10-02T12:39:44.983Z.

Closed by Workflow