[Security Review] Daily Security Review & Threat Model — 2026-06-17

[github-actions[bot]]

📊 Executive Summary

Overall security posture is strong, with defence-in-depth consistently applied. The most recent Secret Digger run (/tmp/gh-aw/escape-test-summary.txt) concluded success with GH_AW_SECRET_VERIFICATION_RESULT: success — credentials remained isolated.

Metric	Value
Files analysed	14 source files, 4 container scripts
Critical findings	0
High findings	2
Medium findings	4
Low findings	3

---

🔍 Escape Test Context

The summary file contained CI metadata, not detailed test output. Outcome: success, no report_incomplete events, no issue-creation errors. Credential isolation controls (one-shot-token, procfs hidepid=2) are functional per codebase evidence.

---

🛡️ Architecture Assessment

Network Security

iptables design (setup-iptables.sh): DNAT redirects 80/443 → Squid 172.30.0.10:3128. Dangerous ports (22/25/3306/5432/6379/27017) get NAT-RETURN then fall to final DROP. UDP dropped entirely except DNS to configured servers. IPv6 disabled via sysctl (line 48).

Finding (Medium): ICMP is not blocked. An agent can perform network reconnaissance (ping, traceroute) within the Docker subnet. No data exfiltration vector, but violates default-deny intent.

Container Security

Capabilities (src/services/agent-service.ts:94): SYS_CHROOT+SYS_ADMIN added for procfs mount; NET_RAW, SYS_PTRACE, SYS_MODULE, SYS_RAWIO dropped. Both elevated caps are dropped via capsh at entrypoint.sh:376 before user code runs.

Finding (High) — SYS_ADMIN race window: The entrypoint runs lines 1–376 as root with SYS_ADMIN before capability drop. Any attacker-controlled exec path in that window could leverage the elevated capability. Risk is low due to strict AWF_* env var validation, but the architectural exposure exists.

Procfs isolation: entrypoint.sh:491 mounts procfs with hidepid=2 — prevents cross-process /proc/[pid]/environ reads, closing the token-extraction race against PID 1.

tmpfs overlays (agent-service.ts): workDir (containing docker-compose.yml with plaintext API keys) is shadowed by tmpfs in both /tmp/awf-* and /host/tmp/awf-* paths.

One-shot token fallback (entrypoint.sh:519): When one-shot-token.so fails on musl/Alpine, tokens remain readable multiple times — logged as WARN, not fatal.

Domain Validation

src/domain-validation.ts: 5-layer validation: (1) empty check, (2) dangerous char check /[\s\0"';#\]/ to prevent Squid config injection, (3) over-broad pattern rejection (, .*`), (4) structural validity, (5) wildcard segment limits.

src/domain-patterns.ts:80: ReDoS prevention — wildcard * → [a-zA-Z0-9.-]* (bounded char class, not .*).

Finding (Medium): --allow-urls passes raw regex to Squid url_regex ACL. While dangerous chars are checked, a complex crafted regex could cause Squid ReDoS. This is operator-only input, not user-controlled.

Input Validation

src/parsers/shell-utils.ts: Safe fast-path for alphanumeric args; single-quote escaping for all others. Port validation rejects leading zeros, matching container-side bash validation.

---

⚠️ Threat Model

#	Category	Threat	Severity
T1	Elevation of Privilege	Agent exploits SYS_ADMIN before capsh drop	High
T2	Information Disclosure	Agent reads docker-compose.yml API keys	High (mitigated by tmpfs)
T3	Tampering	Squid config injection via malformed domain	Medium (mitigated by 5-layer validation)
T4	Evasion	ICMP network mapping in Docker subnet	Medium
T5	Information Disclosure	DNS-based exfiltration via allowed servers	Medium (restricted)
T6	Evasion	Proxy-unaware tools bypass via IPv6	Medium (mitigated by sysctl disable)
T7	Spoofing	API proxy SSRF via crafted URLs	Low
T8	DoS	ReDoS via --allow-urls regex	Low
T9	Repudiation	Actions without log trace	Low (Squid + iptables LOG rules)
T10	Elevation of Privilege	Docker socket escape via --enable-dind	Design decision (off by default)

---

✅ Recommendations

🔴 High

H1 — Narrow SYS_ADMIN window: Split entrypoint into privileged init (mount, drop caps) + unprivileged runner. The procfs mount could be moved to awf-iptables-init or a dedicated init container, eliminating SYS_ADMIN from the agent entirely.

H2 — Block ICMP egress: Add iptables -A OUTPUT -p icmp -j DROP to the default-deny block in setup-iptables.sh. Consistent with existing TCP/UDP DROP policy.

🟡 Medium

M1 — Tighten Claude config permissions: Replace chmod 666 "$config_file" (entrypoint.sh:212/216/248) with chmod 640 and verify awfuser ownership. World-readable config exposes the apiKeyHelper script path within the container.

M2 — One-shot-token fail-closed option: Add --strict-token-isolation flag that exits rather than silently degrading when one-shot-token.so fails to load.

M3 — Validate AWF_DOH_PROXY_IP in iptables script: setup-iptables.sh:124 uses AWF_DOH_PROXY_IP in iptables rules with only an existence check. Add is_valid_ipv4 validation matching the pattern applied to SQUID_IP and AGENT_IP.

🟢 Low

L1 — Add SUID/GUID mount option: System binary mounts (/usr, /bin, /sbin) are read-only but do not specify nosuid. Add ,nosuid to these bind mounts as defense-in-depth against host-side SUID escalation.

L2 — Pin execa version: execa@^5.1.1 uses caret constraint. Pin to exact version to prevent supply-chain substitution.

---

📈 Security Metrics

Metric	Value
Security-critical lines analysed	~1,800
Defence-in-depth layers	4 (iptables + Squid ACL + capabilities + seccomp)
Tested controls	Domain validation ✅ seccomp ✅ shell-utils ✅ squid config ✅
Controls without tests	ICMP blocking (not implemented), one-shot-token fallback

Review date: 2026-06-17 · Model: claude-sonnet-4.6

Generated by Daily Security Review and Threat Modeling · ◷

• expires on Jun 24, 2026, 1:40 PM UTC

[github-actions[bot]]

🔮 The ancient spirits stir; the smoke test agent was here.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-06-24T13:40:04.129Z.

Closed by Workflow