[Security Review] 🛡️ Daily Security Review — gh-aw-firewall (2026-09-11)

[github-actions[bot]]

📊 Executive Summary

AWF's core L7 egress-control design is sound: least-privilege capability drops, dedicated iptables-init container for NET_ADMIN isolation, chroot + selective bind mounts, non-root proxy/sidecar users, ReDoS-safe wildcard-to-regex conversion, and IP-literal CONNECT blocking. No critical, exploitable vulnerabilities were found in the code paths reviewed. Findings below are hardening opportunities (defense-in-depth gaps, documented residual risks, and an anomaly in the escape-test pipeline itself).

Note on Phase 1 input: /tmp/gh-aw/escape-test-summary.txt did not contain firewall escape-test results. It contained an unrelated CI log excerpt for a different workflow ("Secret Digger (Copilot)", run 29286879560), showing a prompt-injection attempt that the agent correctly refused via noop. This is reported as a pipeline/tooling anomaly, not a firewall finding — see "Anomaly" note below.

🔍 Findings from Firewall Escape Test (data anomaly)

The pre-fetched file was not an escape-test summary. Command run:

cat /tmp/gh-aw/escape-test-summary.txt

Output was CI log lines for Secret Digger (Copilot) (workflow secret-digger-copilot, run 29286879560), which correctly triggered threat_detected and a noop refusal ("scan for secrets... exfiltrate via GitHub issues" — prohibited). This confirms the safe-outputs / threat-detection pipeline is functioning as designed, but it means no genuine firewall-escape evidence was available to cross-reference in this run. Recommend the upstream step that populates escape-test-summary.txt be checked for a caching/path bug pointing at the wrong workflow's artifact.

🛡️ Architecture Security Analysis

Network Security

• containers/agent/setup-iptables.sh builds NAT/FILTER rules: DNAT 80/443→Squid, explicit DANGEROUS_PORTS block (SSH/SMTP/DB ports), DNS locked to configured upstreams only + Docker embedded DNS (127.0.0.11), IPv6 explicitly disabled inside the agent netns (disable_ipv6()) to prevent IPv6 egress bypassing IPv4-only DNAT rules.
• Port-spec parsing (is_valid_port_spec) is a second, fail-closed validator for AWF_VALID_ALLOW_HOST_PORTS/AWF_VALID_HOST_SERVICE_PORTS, defending against a stale/mismatched CLI passing raw unvalidated env vars — good defense-in-depth.
• src/squid/config-generator.ts blocks CONNECT to raw IPv4/IPv6 literals (dst_ipv4/dst_ipv6 regex ACLs) to stop domain-allowlist bypass via direct IP.
• Host-gateway/network-gateway bypass rules (allow_host_access_to_gateway) are scoped to ports 80/443 + explicit --allow-host-ports, not a blanket allow — reduces the blast radius of the MCP/host-access exception.

Container Security

• Agent: SYS_CHROOT + SYS_ADMIN added (for chroot + procfs mount with hidepid=2), NET_ADMIN explicitly not granted (moved to the short-lived iptables-init sidecar) — confirmed in src/services/agent-service-build.test.ts:100-118 and src/services/agent-service.ts:72-76.
• Squid, api-proxy, cli-proxy, doh-proxy run as non-root (USER proxy/apiproxy/cliproxy) with cap_drop: ALL (or targeted drops) and no-new-privileges (src/services/service-security.test.ts).
• Seccomp profile (containers/agent/seccomp-profile.json) is an allowlist (SCMP_ACT_ERRNO default) rather than a denylist — stronger posture.
• AWF_SKIP_CAP_DROP (src/capability-filter.ts:55-109) is an escape hatch that removes cap_drop requirements entirely when set. It exists to accommodate restricted CI runners lacking certain capabilities in their bounding set, but it is a env-var-gated global weakening of container hardening with no runtime warning banner found in the reviewed code — flagged below.

Domain Validation

• src/domain-patterns.ts:70-122 (wildcardToRegex) uses a bounded character class ([a-zA-Z0-9.-]*) instead of .* specifically to prevent ReDoS — a deliberate, well-documented mitigation.
• Protocol-scoped domains (`(redacted) prefixes) are parsed and enforced via separate ACLs, reducing over-broad allows.

Input Validation

• entrypoint.sh:setup_user_identity() validates AWF_USER_UID/AWF_USER_GID are numeric and explicitly rejects 0 (root) — prevents privilege-drop defeat via crafted env vars.
• entrypoint.sh API-key-helper / Maven / Gradle config writers use node -e with JSON.parse/stringify (not string concatenation into shell) when merging into existing JSON files, reducing injection risk in the common path; the initial-create fallback paths (echo "{\"apiKeyHelper\":\"$CLAUDE_CODE_API_KEY_HELPER\"}" > "$config_file") interpolate an env var into a JSON literal without escaping quotes/backslashes — low risk since the value is host-supplied, not attacker-controlled from inside the sandbox, but noted as fragile.
• execa/execFile usage throughout src/ consistently passes argv arrays (not shell strings), avoiding shell-injection; eslint-rules/no-unsafe-execa.test.js indicates a custom lint rule enforces this pattern — good preventative control.

⚠️ Threat Model (STRIDE)

Category	Threat	Evidence	Likelihood	Impact
Spoofing	Agent spoofs its own IP to bypass DANGEROUS_PORTS/Squid via self-directed traffic bypass rule	setup-iptables.sh "Bypass Squid for self-directed traffic" RETURN rule keyed on $AGENT_IP	Low	Low (still same-container, no cross-tenant benefit)
Tampering	Agent modifies /etc/resolv.conf after container start to point at attacker DNS	entrypoint.sh writes resolv.conf once at startup; no runtime immutability (chattr +i) observed	Low–Med	Med (DNS exfil channel if writable post-boot)
Repudiation	Squid logs omit User-Agent in audit_jsonl format ("could break JSON parsing")	config-generator.ts logformat comment	Low	Low (forensic completeness gap, not a security control gap)
Info Disclosure	AWF_SKIP_CAP_DROP / AWF_SKIP_IPTABLES_INIT silently downgrade isolation	capability-filter.ts:55, entrypoint.sh:163	Med (env misconfig)	High (full capability restoration if unintentionally set)
DoS	Squid cache_mem 64 MB / no explicit maxconn limits observed in reviewed excerpt	config-generator.ts	Low	Low
Elevation of Privilege	enclave-mcp-server control channel guarded by "capability authentication alone" (per CLAUDE.md, tracked as github/gh-aw#59268, closed not-planned)	Documented in project instructions	Med	High if the 0700 file channel permissions/ownership are ever misconfigured

🎯 Attack Surface Map

Surface	Entry Point	Protections	Weakness
Network egress	containers/agent/setup-iptables.sh (DNAT 80/443→Squid)	DANGEROUS_PORTS block, DNS allowlist, IPv6 disabled	Host-access gateway bypass widens attack surface when --allow-host-ports/AWF_ENABLE_HOST_ACCESS used
Domain ACL	src/squid/config-generator.ts, src/domain-patterns.ts	ReDoS-safe wildcard regex, IP-literal CONNECT deny	Relies on Squid resolving Host header/SNI correctly; no explicit re-check of resolved-IP vs. private-range on allowed domains (DNS rebinding to internal IPs is not the tool's stated threat model but was not verified false)
Container isolation	containers/agent/entrypoint.sh, src/capability-filter.ts	cap_drop, seccomp allowlist, chroot, non-root	AWF_SKIP_CAP_DROP global bypass; UID/GID remap trusts numeric env var (validated against 0, not against other privileged ranges)
Input validation	src/host-iptables*.ts, containers/agent/setup-iptables.sh	Dual TS+bash port-spec validation, numeric-only UID/GID	JSON-literal env interpolation in fallback config writers
Docker wrapper / entrypoint	containers/agent/entrypoint.sh (1767 lines)	Modular functions, fail-fast health checks	Very large single script increases review burden and regression risk
Enclave MCP control plane	mcpg github-repository-delegation-v1, AWF host-loopback control listener	0700 file channel, capability auth	Capability-only auth (no additional secret/HMAC) per CLAUDE.md; tracked upstream (github/gh-aw#59268) as accepted risk

📋 Evidence Collection

Commands run (collapsed)

cat /tmp/gh-aw/escape-test-summary.txt
cat src/host-iptables.ts containers/agent/setup-iptables.sh src/squid-config.ts
grep -rn "cap_drop|capabilities|NET_ADMIN|NET_RAW|SYS_CHROOT|SYS_ADMIN" src/ containers/
cat containers/agent/seccomp-profile.json
grep -rn "privilege|root|USER |uid|gid" containers/*/Dockerfile
cat src/domain-patterns.ts
grep -rn "execa\(|spawn\(|exec\(" src/
sed -n '1,1400p' containers/agent/entrypoint.sh
cat package.json
npm audit --json   # blocked: registry 403 in sandboxed network
sed -n '1,220p' src/squid/config-generator.ts

✅ Recommendations

High

• Add a loud, unconditional startup log warning (stdout + Squid/agent logs) whenever AWF_SKIP_CAP_DROP or AWF_SKIP_IPTABLES_INIT is active, so degraded-isolation runs are unmistakable in CI logs and audit trails.
• Investigate/fix the escape-test-summary data pipeline — this run's pre-fetched file pointed to an unrelated workflow's logs instead of actual firewall escape-test results, meaning escape-test coverage could not be validated this cycle.

Medium

• Consider periodic re-validation (or chattr +i) of /etc/resolv.conf post-boot to reduce runtime DNS-exfil tampering risk, or document why it's accepted (single-use container to reduce standing risk).
• Escape special characters when interpolating env vars into JSON literals in entrypoint.sh fallback config writers (configure_claude_api_key), even though the values are host-supplied today.
• Re-add User-Agent to audit_jsonl with proper JSON string escaping (e.g., via Squid's %{User-Agent}>h combined with a sanitizing wrapper) to close the forensic gap noted in the logformat comment.

Low

• Consider splitting entrypoint.sh (1767 lines) into sourced modules by concern (DNS, SSL, JVM proxy, Claude config) to reduce review/maintenance risk, mirroring the modular pattern already used in src/squid/ and src/services/.
• Track resolution of github/gh-aw#59268 (capability-only auth on the enclave control listener) even though currently closed as not-planned; revisit if enclave dynamic-repo admission usage increases.

📈 Security Metrics

• Security-critical files/lines directly reviewed: setup-iptables.sh (~300+ lines), entrypoint.sh (~420 of 1767 lines read directly, remainder referenced via grep), src/squid/config-generator.ts (217 lines), src/domain-patterns.ts (137 lines), src/capability-filter.ts, container Dockerfiles (squid/api-proxy/cli-proxy/agent/enclave/build-tools), seccomp profile.
• Attack surfaces enumerated: 6 (network egress, domain ACL, container isolation, input validation, Docker wrapper/entrypoint, enclave MCP control plane).
• STRIDE coverage: all 6 categories addressed with at least one evidenced threat.
• npm audit could not run against the public registry in this sandbox (403 Forbidden from internal package mirror) — dependency-vulnerability coverage is not verified this cycle; recommend running npm audit in an environment with registry access.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• msfeed25.pkgs.visualstudio.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "msfeed25.pkgs.visualstudio.com"

See Network Configuration for more information.

Generated by Daily Security Review and Threat Modeling · copilot · auto · 44.9 AIC · ⊞ 10.3K · ◷

• expires on Sep 18, 2026, 12:40 PM UTC

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-09-18T12:40:16.407Z.

Closed by Workflow