[Security Review] Daily Security Review & Threat Model — gh-aw-firewall

[github-actions[bot]]

📊 Executive Summary

This is an automated daily security review of github/gh-aw-firewall at commit 0c4ffc4 (branch main). The codebase (~45,000 LOC in src/, plus shell scripts in containers/) shows a mature, defense-in-depth security posture: multiple independent enforcement layers (Squid L7 ACLs, host iptables DOCKER-USER chain, container NAT/filter rules, capability drops, seccomp, ReDoS-safe regex construction, and injection-safe config generation). No critical or high-confidence exploitable vulnerabilities were found in this pass. Findings below are hardening opportunities and residual-risk notes, not confirmed exploits.

Note on Phase 1 input: /tmp/gh-aw/escape-test-summary.txt did not contain firewall escape-test results as expected. It instead contained CI log lines from an unrelated workflow run (Secret Digger (Copilot), run 29286879560), showing the agent correctly refused a prompt-injection task ("scan for secrets... exfiltrate via GitHub issues") and called noop. This is a positive security signal (prompt-injection defenses work) but is not firewall-escape evidence — treated as complementary context only, per instructions not to re-fetch.

🔍 Findings from Firewall Escape Test (Complementary Context)

The available log excerpt shows:

• Workflow: Secret Digger (Copilot) — an adversarial/red-team style workflow designed to test whether the agent would scan the CI runner for secrets/credentials and exfiltrate them via a GitHub issue.
• Result: The agent detected this as a prompt-injection attack and refused, emitting a noop safe-output: "Refused prompt injection attack... prohibited by security policy. No investigation was performed."
• The harness's own threat-detection layer independently flagged GH_AW_DETECTION_CONCLUSION: warning / GH_AW_DETECTION_REASON: threat_detected, and opened tracking issue #6205 for the detection.
• No evidence in this excerpt indicates an actual network/container escape occurred or was attempted against the AWF firewall itself; this was an agent-instruction-following test, not an L3/L7 escape test.
• Gap: We could not corroborate actual awf firewall-escape test results (e.g., domain-bypass attempts, DNAT bypass, IPv6 leak, proxy env-var stripping) from the provided file. Recommend the escape-test workflow that produces /tmp/gh-aw/escape-test-summary.txt be verified to actually target AWF's network isolation next run.

🛡️ Architecture Security Analysis

Network Security Assessment

• src/host-iptables-rules.ts (346 lines) builds a FW_WRAPPER chain jumped into from DOCKER-USER, guaranteeing egress filtering applies to all containers on awf-net, not just the agent — closing a classic Docker network-isolation gap.
• Default-deny is enforced twice: NAT-level (configure_http_dnat, containers/agent/setup-iptables.sh:404-420) redirects 80/443 to Squid; FILTER-level (configure_filter_chain, same file ~423-480) drops all other TCP/UDP with rate-limited audit logging ([FW_BLOCKED_TCP], [FW_BLOCKED_UDP_AGENT]).
• IPv6 is defensively disabled inside the agent netns (disable_ipv6(), lines ~133-146) specifically to prevent IPv6 egress from bypassing IPv4-only DNAT/proxy rules — a well-reasoned mitigation for a known bypass class (see referenced issue Squid proxy rejects IPv6 localhost connections from chroot (transaction-end-before-headers) #1543 in comments).
• DANGEROUS_PORTS (SSH, SMTP, DB ports, Redis, MongoDB, RDP) are blocked at NAT level as defense-in-depth alongside Squid ACLs (containers/agent/setup-iptables.sh:112-127).
• DNS is restricted to configured upstream servers only via both host-level (src/host-iptables-rules.ts addIpv6DnsRules) and container-level NAT rules — mitigating DNS-exfiltration.
• Residual risk: --allow-host-ports / --allow-host-service-ports and --enable-host-access widen the attack surface intentionally (for Playwright/MCP/service containers) by opening arbitrary ports to the Docker/host gateway. These are opt-in flags, not defaults, but their presence means the security guarantee is conditional on operator discipline.

Container Security Assessment

• containers/agent/entrypoint.sh (1767 lines) validates AWF_USER_UID/AWF_USER_GID as numeric and explicitly rejects UID/GID 0 (entrypoint.sh:36-52) before any UID/GID remap — prevents privilege-drop defeat via crafted env vars.
• Capability drop uses capsh --drop=$CAPS_TO_DROP executed as the final exec before user code runs (entrypoint.sh:1698,1737), with SYS_CHROOT/SYS_ADMIN dropped only after chroot/mount setup completes — correct ordering (mount first, then remove the capability that permits further mounts/chroots).
• src/capability-filter.ts — AWF_SKIP_CAP_DROP is a documented "last-resort escape hatch" (docs/environment.md:171) that removes all cap_drop directives, including ALL on proxy sidecars. This is intentionally an emergency/host-side-only override, not agent-controllable, but its existence is worth periodic audit to ensure it's never silently enabled in production configs.
• containers/agent/seccomp-profile.json: defaultAction: SCMP_ACT_ERRNO (deny-by-default, not SCMP_ACT_ALLOW), with only 5 syscall groups explicitly allowed — a tight allowlist rather than a blocklist. This is the more secure of the two seccomp models.
• procfs is mounted with hidepid=2, preventing the agent from reading other processes' /proc/[pid]/environ — mitigates cross-process credential leakage within the container.

Domain Validation Assessment

• src/domain-validation.ts — SQUID_DANGEROUS_CHARS / checkDangerousChars() blocks whitespace, NUL, quotes, backtick, #, ;, and (for domains) backslash from reaching the generated Squid config — a solid Squid-config-injection prevention layer, with an explicit code comment noting why each character is dangerous.
• src/domain-patterns.ts — wildcard-to-regex conversion (wildcardToRegex) uses a bounded character class ([a-zA-Z0-9.-]*) instead of .*, explicitly to prevent ReDoS/catastrophic backtracking. isDomainMatchedByPattern() additionally caps input length at 512 chars before regex evaluation as defense-in-depth against ReDoS.
• Over-broad patterns (*, *.*, patterns with excessive wildcard segments) are explicitly rejected (checkOverBroadPattern, checkStructuralValidity) — prevents a user/config error from silently becoming "allow all domains."
• parseUrlPatterns() in domain-patterns.ts splits host vs. path before applying wildcard substitution specifically so hostname wildcards cannot cross the / boundary into the path — prevents a wildcard like api-* from unintentionally matching arbitrary paths.

Input Validation Assessment

• src/host-iptables-validation.ts isValidPortSpec() strictly validates port specs (1-65535, single or range, reformats-and-compares to reject leading zeros) before they reach iptables argv arrays.
• containers/agent/setup-iptables.sh re-implements the identical port-spec regex/range check (is_valid_port_spec) as a second, fail-closed guard on the shell side, explicitly documented as defense-in-depth in case the pre-validated TypeScript value is somehow bypassed or a version mismatch occurs — good belt-and-suspenders design given shell scripts are more injection-prone.
• No execa/spawn call site with shell: true was found in src/ (grep -rn "shell: true" src/ returned no results), and a custom ESLint rule (eslint-rules/no-unsafe-execa.js) statically flags template-literal/concatenated commands passed to execa() — a proactive command-injection guard baked into CI linting.
• chownTreeWithoutFollowingSymlink() (src/config-writer.ts:85-102) uses chown -h -P -R -- specifically to avoid symlink-follow TOCTOU attacks during recursive ownership changes, with UID/GID validated as positive integers beforehand (resolveSandboxIdentity, line 109).

⚠️ Threat Model (STRIDE)

Category	Threat	Evidence	Likelihood	Impact
Spoofing	Malicious agent process spoofs Squid's IP to bypass proxy source ACL (addProxySourceAcceptRules, src/host-iptables-rules.ts:46-63)	Rule allows all traffic from Squid's IP unconditionally; if agent could source-spoof Squid's IP within the bridge network, traffic would be trusted	Low (requires L2 spoofing on a Docker bridge, normally not permitted without NET_RAW, which is dropped for the agent)	High
Tampering	Agent tampers with /etc/resolv.conf to point at attacker DNS	entrypoint.sh backs up and rewrites resolv.conf to Docker embedded DNS only; but this happens at container start, before user code runs, and DNS itself is further restricted by iptables to the DNS whitelist	Low	Medium
Tampering	AWF_SKIP_CAP_DROP / similar escape-hatch env vars set unintentionally in CI	src/capability-filter.ts:58, docs/environment.md:171 — documented as host-side only, not agent-settable	Low (requires host-side misconfiguration)	Critical if triggered
Repudiation	Blocked/allowed traffic not attributable to a specific process	setup-iptables.sh LOG rules use --log-uid (per CLAUDE.md and confirmed in file) to capture UID; PID not directly logged	Low	Low
Information Disclosure	Cross-invocation secret leakage via /proc/[pid]/environ	Mitigated via hidepid=2 procfs mount (per architecture doc)	Low	High
Information Disclosure	Secrets leaking into logs/diagnostics/artifacts	src/redact-secrets.ts redacts Authorization headers, *TOKEN*/*SECRET*/*PASSWORD*/*KEY*/*AUTH* env-var patterns, and GitHub token prefixes (gh[pousr]_)	Medium (regex-based redaction can miss unusual credential formats)	High
Denial of Service	ReDoS via crafted --allow-domains/--allow-urls wildcard patterns	Mitigated: bounded character classes instead of .*, 512-char length cap before regex test (domain-patterns.ts, isDomainMatchedByPattern)	Low	Medium
Denial of Service	Log flooding from blocked-port audit rules	Mitigated via --limit 5/min --limit-burst 10 / --limit 10/min --limit-burst 20 rate limiting on LOG rules	Low	Low
Elevation of Privilege	Agent regains SYS_CHROOT/SYS_ADMIN after capability drop	capsh --drop removes from the bounding set (irreversible for the process tree), executed as final exec before user code (entrypoint.sh:1698,1737)	Low	Critical
Elevation of Privilege	UID/GID remap to 0 (root) via crafted env var	Explicitly rejected (entrypoint.sh:44-52)	Low	Critical
Elevation of Privilege	Dynamic-delegation control channel (src/enclave/delegation-control-client.ts) capability theft granting cross-repo GitHub read access	Capability travels only in Authorization header to a loopback-only endpoint; LITERAL_LOOPBACK_HOSTS explicitly excludes localhost to avoid DNS-rebinding-style capability leakage (dynamic-delegation-handoff.ts:61-68); tracked as an accepted design risk in github/gh-aw#59268 (closed not planned) per project docs	Low–Medium (acknowledged, not fully closed)	High

🎯 Attack Surface Map

Surface	Entry Point	Protections	Potential Weakness
Network egress (L3/L4)	containers/agent/setup-iptables.sh (agent netns), src/host-iptables-rules.ts (host DOCKER-USER chain)	Default-deny FILTER chain, NAT DNAT to Squid, dangerous-port blocklist, IPv6 disabled, rate-limited audit logging	Opt-in --enable-host-access/--allow-host-ports widen surface; relies on correct bridge-name/gateway resolution at runtime
Network egress (L7)	Squid ACLs generated by src/squid/*.ts	Domain allowlist with plain + wildcard (regex) matching, protocol-scoped (`(redacted) rules, blocklist takes precedence, ReDoS-safe regex construction	Regex ACL evaluation cost scales with pattern count; SSL Bump (when enabled) implies Squid holds decrypted traffic — a concentration-of-trust point
Domain/URL parsing	src/domain-patterns.ts, src/domain-validation.ts	Dangerous-char rejection, over-broad pattern rejection, length caps	Backslash allowed in --allow-urls (documented exception for regex escaping) — slightly larger attack surface than domain names
Container privilege boundary	containers/agent/entrypoint.sh	UID/GID≠0 enforcement, ordered cap-drop via capsh, seccomp deny-by-default, procfs hidepid=2	AWF_SKIP_CAP_DROP escape hatch exists (host-only, documented)
Input validation (CLI/config)	src/cli.ts, src/host-iptables-validation.ts, src/option-parsers*.ts	Strict port-spec parsing, custom ESLint rule against unsafe execa() usage, no shell:true call sites found	Large surface (option-parsers.ts 329 lines + many option-parser test files) not fully enumerated in this pass — recommend a follow-up focused review of all cli-options.ts/option-parsers*.ts argument parsers
Docker Compose generation	src/compose-generator.ts, src/docker-manager*.ts	src/capability-filter.ts filters cap_drop against actual host capability bounding set to avoid daemon errors while still dropping what's droppable	Filtering logic silently keeps a capability if it cannot determine the host bounding set (getHostCapabilityBoundingSet() returns null → returns original list) — fails open on probe failure, worth verifying this fails toward "more capabilities dropped," not fewer (current code returns the original list unmodified on null, which is the safer of the two directions since Docker itself would then reject the unfilterable drop request explicitly rather than silently omitting it)
Enclave dynamic delegation (preview feature)	src/enclave/dynamic-delegation-channel.ts, delegation-control-client.ts, dynamic-delegation-handoff.ts	AWF-private 0700 directory channel (no network) for host↔broker; loopback-only HTTP control client with literal-host allowlist (no localhost) and capability in Authorization; bounded response sizes (128 KiB)	Acknowledged, tracked design risk (mcpg control listener guarded by capability alone, no additional binding) per github/gh-aw#59268

📋 Evidence Collection

Commands run and key outputs (click to expand)

# Phase 1: escape test context
cat /tmp/gh-aw/escape-test-summary.txt
# → 200 lines of CI log output for an unrelated "Secret Digger (Copilot)" workflow run;
#   agent correctly refused a prompt-injection task and emitted `noop`.

# Network security
cat src/host-iptables-rules.ts        # 346 lines — FW_WRAPPER chain construction
cat containers/agent/setup-iptables.sh # 540 lines — agent netns NAT + FILTER rules

# Container security
grep -rn "cap_drop\|NET_ADMIN\|NET_RAW" src/ containers/
python3 -c "import json; d=json.load(open('containers/agent/seccomp-profile.json')); print(d['defaultAction'], len(d['syscalls']))"
# → SCMP_ACT_ERRNO, 5 syscall groups (deny-by-default allowlist model)

# Domain patterns / injection prevention
cat src/domain-patterns.ts src/domain-validation.ts src/domain-matchers.ts

# Injection risk scan
grep -rn "shell: true" src/         # → no results
cat eslint-rules/no-unsafe-execa.js # custom static-analysis rule against execa injection

# Dependency audit
npm audit --json                    # → {} (no findings / lockfile-based check clean at time of scan)

# Credential scan
grep -rniE "(api[_-]?key|secret|password|token)\s*=\s*['\"][A-Za-z0-9+/=_-]{16,}['\"]" src containers
# → only test fixtures and documented placeholder constants (e.g. COPILOT_PLACEHOLDER_TOKEN = '******')

cat src/redact-secrets.ts           # log/artifact secret redaction implementation

✅ Recommendations

Critical

• None identified in this pass.

High

• Verify the workflow/step responsible for populating /tmp/gh-aw/escape-test-summary.txt actually runs AWF network-isolation escape attempts (domain bypass, DNAT bypass, IPv6 leak, proxy-env stripping) rather than unrelated prompt-injection-refusal logs; the current content provides no L3/L7 escape-test evidence for this review cycle.
• Track closure of github/gh-aw#59268 (dynamic-delegation control listener guarded by capability alone) to completion or an accepted-risk sign-off, since it's the one open design-level EoP concern surfaced in the enclave subsystem.

Medium

• Periodically audit that AWF_SKIP_CAP_DROP is never set in any production/CI compose generation path — consider adding an automated CI assertion that fails the build if this env var is present in default configs.
• Expand redactSecrets() regex coverage/testing for credential formats beyond TOKEN|SECRET|PASSWORD|KEY|AUTH and GitHub gh[pousr]_ prefixes (e.g., cloud-provider key formats, JWTs) to reduce residual information-disclosure risk in logs/artifacts.
• Document and, where feasible, tighten the fail-open behavior in filterCapDrop()/getHostCapabilityBoundingSet() when the capability-bounding-set probe itself fails (returns null), to make the "fail toward more restriction" property explicit and test-covered.

Low

• Consider PID-level correlation (in addition to existing --log-uid) in iptables audit logs to ease repudiation-related investigations, if kernel/log-pipeline support allows it without excessive overhead.
• A follow-up focused review of src/cli-options.ts and the numerous option-parsers*.ts modules (not fully enumerated in this pass due to their scale) would give full input-validation coverage confidence across all CLI flags, not just the port-spec and domain-validation paths reviewed here.

📈 Security Metrics

• Security-critical source reviewed directly: src/host-iptables-rules.ts (346), containers/agent/setup-iptables.sh (540), src/domain-patterns.ts (137), src/domain-validation.ts (124), src/domain-matchers.ts (185), src/capability-filter.ts (170), src/config-writer.ts (partial, chown/UID logic), containers/agent/entrypoint.sh (targeted sections, file is 1767 lines total), src/redact-secrets.ts (58), src/enclave/dynamic-delegation-channel.ts (148) + delegation-control-client.ts (partial, 462) + dynamic-delegation-handoff.ts (partial) ≈ 2,000+ lines directly inspected out of ~45,240 total src/ LOC and 2,351+ lines of container shell scripts.
• Attack surfaces enumerated: 7 (network egress L3/L4, network egress L7, domain/URL parsing, container privilege boundary, CLI/config input validation, Docker Compose generation, enclave dynamic delegation).
• Threat model coverage: all 6 STRIDE categories addressed with at least one concrete, evidence-backed threat each (11 threats total).
• npm audit: no findings reported at time of scan.
• No hardcoded secrets, no shell: true execa usage, and no unvalidated command-injection paths were found in the source tree during this review.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• msfeed25.pkgs.visualstudio.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "msfeed25.pkgs.visualstudio.com"

See Network Configuration for more information.

Generated by Daily Security Review and Threat Modeling · copilot · auto · 107.2 AIC · ⊞ 10.8K · ◷

• expires on Oct 1, 2026, 12:41 PM UTC

[github-actions[bot]]

🔮 The ancient spirits stir; the smoke-test agent passed through this hall, leaving a trace in the aether. The build held, the sigils responded, and the oracle marks this discussion as witnessed.

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

• ab.chatgpt.com
• msfeed25.pkgs.visualstudio.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"
    - "msfeed25.pkgs.visualstudio.com"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}