[Security Review] Daily Security Review & Threat Model — 2026-06-16

[github-actions[bot]]

Review date: 2026-06-16 | Model: claude-sonnet-4.6 | Scope: Full static analysis

📊 Executive Summary

Metric	Value
Security-critical lines analysed	~2,784 (9 core files)
Total source files	295 TS + Bash
Findings	0 Critical · 0 High · 3 Medium · 4 Low
Prior escape-test result	No findings (agent concluded noop)

Overall posture: GOOD. Defence-in-depth is well-implemented across L3/L4 (iptables), L7 (Squid ACL), container capabilities, seccomp, and credential isolation.

---

🔍 Escape Test Context

The escape-test summary (/tmp/gh-aw/escape-test-summary.txt) contained workflow infrastructure metadata from the "Secret Digger (Copilot)" run (2026-04-11). It concluded with GH_AW_SECRET_VERIFICATION_RESULT: success and noop — no secrets exfiltrated, no escape vectors found.

---

🛡️ Architecture Strengths

• Two-layer egress: host DOCKER-USER chain (src/host-iptables-rules.ts) + per-container NAT rules (containers/agent/setup-iptables.sh).
• IPv6 disabled in agent network namespace (setup-iptables.sh:47-49) — blocks Happy Eyeballs bypass.
• Dangerous ports blocked at NAT RETURN + filter DROP (SSH:22, SMTP:25, MySQL:3306, Redis:6379, MongoDB:27017 ... 15 ports total).
• UDP dropped by default except whitelisted DNS upstream servers.
• NET_ADMIN never granted to agent — held only by short-lived awf-iptables-init init container.
• SYS_CHROOT/SYS_ADMIN dropped via capsh before user code runs (entrypoint.sh:375-377).
• Seccomp default-deny (SCMP_ACT_ERRNO): ptrace, process_vm_readv/writev, kexec_load, reboot, umount all blocked.
• hidepid=2 on procfs prevents agent reading /proc/[pid]/environ of entrypoint (entrypoint.sh:491).
• One-shot-token C library (LD_PRELOAD) prevents re-reading credentials; unset_sensitive_tokens() clears PID 1 env.
• Domain injection blocked: SQUID_DANGEROUS_CHARS = /[\s\0"';#]/+ backslash at every Squid config interpolation point;validateApiProxyIp()` strict IPv4 regex.
• Wildcard ReDoS protection: DOMAIN_CHAR_PATTERN = '[a-zA-Z0-9.-]*' — char class not .*.

---

⚠️ Findings

M-1 (Medium) — ICMP not blocked in agent OUTPUT chain

Evidence: containers/agent/setup-iptables.sh:426-433 drops only TCP and UDP. No ICMP rule exists.

iptables -A OUTPUT -p tcp -j DROP
iptables -A OUTPUT -p udp -j DROP
# ICMP missing — covert channel / ping-tunnel possible

Recommendation: Add iptables -A OUTPUT -p icmp -j DROP after DNS allow rules in setup-iptables.sh. Mirror in src/host-iptables-rules.ts:addBlockRules().

---

M-2 (Medium) — apparmor:unconfined removes MAC enforcement on agent

Evidence: src/services/agent-service.ts:111

security_opt: [
  'no-new-privileges:true',
  `seccomp=${config.workDir}/seccomp-profile.json`,
  'apparmor:unconfined',   // MAC policy disabled
],

Required to allow mount() for procfs. However, between container start and capsh execution, there is no MAC policy. Seccomp provides partial compensation.

Recommendation: Develop a minimal custom AppArmor profile permitting only mount fstype=proc while blocking other mount types and namespace operations. Current seccomp + capability drop provides adequate interim mitigation.

---

M-3 (Medium) — git safe.directory '*' global wildcard

Evidence: containers/agent/entrypoint.sh:366

runuser -u awfuser -- git config --global --add safe.directory '*'

Bypasses git protections against executing .git/hooks from untrusted directory ownership contexts. If the agent clones from an attacker-controlled repo, malicious hooks could execute.

Recommendation:

# Restrict to workspace only
runuser -u awfuser -- git config --global --add safe.directory "${WORKSPACE_PATH}"
# Disable hooks from untrusted clones
runuser -u awfuser -- git config --global core.hooksPath /dev/null

---

L-1 (Low) — JSONL audit log URL field unescaped

Evidence: src/squid/config-generator.ts:97

logformat audit_jsonl {...,"url":"%ru"}

%ru is not JSON-escaped. A URL containing ","event":"fake_allow" could inject a synthetic log entry. User-Agent was already removed for this reason; URL has the same risk.

Recommendation: Treat lines failing JSON parse in log-parser.ts as tampered/invalid rather than skipped. Long-term: evaluate Squid native JSON escaping.

---

L-2 (Low) — Unencrypted DNS without DoH mode

Without --doh, DNS queries for every domain the agent resolves are sent unencrypted (default: Google 8.8.8.8). A network observer can enumerate the agent's full task scope.

Recommendation: Add logger.warn() when DoH is not enabled. Consider making DoH opt-out rather than opt-in in a future release.

---

L-3 (Low) — js-yaml moderate vulnerability in production dependency

Evidence: npm audit output: js-yaml: severity=moderate.

Used in src/compose-sanitizer.ts and src/compose-generator.ts. AWF generates YAML programmatically (low exposure), but the advisory should be cleared.

Recommendation: npm audit fix or pin to patched version.

---

L-4 (Low) — JSONL log resilience for URL-encoded newlines

SQUID_DANGEROUS_CHARS blocks literal whitespace but not %0a-encoded newlines in URLs, which Squid may expand when writing %ru. A crafted URL could split a JSONL entry across lines.

Recommendation: In src/logs/log-parser.ts, treat any line not starting with a valid Unix timestamp as a continuation error.

---

⚠️ STRIDE Summary Table

ID	Category	Threat	Status
S1	Spoofing	Agent spoofs Squid IP to bypass DNAT	✅ NAT RETURN for Squid IP
T1	Tampering	Replace one-shot-token.so in /tmp	✅ Host /tmp ownership
T2	Tampering	Modify iptables after init exits	✅ NET_ADMIN never granted to agent
R1	Repudiation	Inject JSONL log via crafted URL	⚠️ L-1
I1	Info Disclosure	Read credentials via /proc/1/environ	✅ hidepid=2 + one-shot-token
I2	Info Disclosure	DNS enumeration (unencrypted)	⚠️ L-2
D1	DoS	Fork bomb	✅ pids_limit: 1000
D2	DoS	OOM	✅ mem_limit: 6g
D3	DoS	ICMP covert channel	⚠️ M-1
E1	EoP	Escape before capsh drops SYS_ADMIN	⚠️ M-2 (AppArmor unconfined)
E2	EoP	Malicious git hooks	⚠️ M-3
E3	EoP	Capability re-acquisition	✅ no-new-privileges + seccomp

---

📈 Security Metrics

Metric	Value
Lines of security-critical code	2,784
STRIDE threats evaluated	12
Threats mitigated	8 / 12 (67%)
Findings raised	7 (0C / 0H / 3M / 4L)
Production npm vulns	1 moderate (js-yaml)
Escape test result	No findings

Generated by Daily Security Review and Threat Modeling · ◷

• expires on Jun 23, 2026, 2:18 PM UTC

[github-actions[bot]]

🔮 The ancient spirits stir: the smoke test agent was here, and the omens read in favor of a passing run.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-06-23T14:18:05.409Z.

Closed by Workflow