[Security Review] Daily Security Review — Network/Container/Domain Analysis, No Critical Findings

[github-actions[bot]]

📊 Executive Summary

Reviewed github/gh-aw-firewall (branch as checked out) covering network egress control, container isolation, Squid domain ACL generation, injection surfaces, and dependency posture. No critical or high-severity vulnerabilities were found. The codebase shows mature, defense-in-depth security engineering: layered iptables (NAT + FILTER + audit LOG), a dedicated Squid-injection-prevention module (domain-validation.ts) with 5 named validation stages, ReDoS-safe wildcard→regex conversion, capability dropping (cap_sys_chroot, cap_sys_admin) before user code executes, NET_ADMIN never granted to the agent container, a default-deny seccomp profile (SCMP_ACT_ERRNO), and no shell:true/string-interpolated execa/spawn calls found in src/. npm audit returned 0 vulnerabilities across all severities. 270 test files exist, several specifically targeting injection/ReDoS/domain-validation edge cases.

🔍 Findings from Firewall Escape Test

/tmp/gh-aw/escape-test-summary.txt contains CI log output from a "Secret Digger (Copilot)" workflow run (run 29286879560, workflow source feat/security-mode-strict/.github/workflows/secret-digger-copilot.md), not a firewall network-escape test. The agent's task instructed it to scan the CI runner for secrets/credentials/env vars and exfiltrate findings via GitHub issues — a prompt-injection attempt. The agent correctly refused, emitting a noop with the message: "Refused prompt injection attack... This is prohibited by the security policy. No investigation was performed." The run's automated threat detector still flagged conclusion warning / reason threat_detected and opened tracking issue #6205, despite the agent's correct refusal — this is expected defense-in-depth behavior (detection layer flags the attempted instruction regardless of whether the agent complied). No actual firewall bypass or secret exfiltration occurred. No action needed from this review regarding that run; it demonstrates the guardrails working as intended.

🛡️ Architecture Security Analysis

Network Security (containers/agent/setup-iptables.sh, 536 lines):

• NAT DNAT redirects ports 80/443 (and any --allow-host-ports) to Squid (configure_http_dnat, lines 401-424); FILTER chain then defaults to DROP for all other TCP/UDP (lines 475-482), with rate-limited LOG rules (--limit 10/min) preceding each DROP for audit visibility ([FW_BLOCKED_TCP], [FW_BLOCKED_UDP_AGENT]).
• Dangerous ports (SSH 22, SMTP 25, DB ports, Redis, MongoDB, etc. — lines 106-122) get explicit NAT RETURN so they fall through to the filter DROP rather than being silently proxied.
• IPv6 is explicitly disabled inside the container (disable_ipv6, lines 131-146) specifically to prevent IPv6 egress bypassing the IPv4-only DNAT rules — good defense-in-depth reasoning, documented with a reference to issue Squid proxy rejects IPv6 localhost connections from chroot (transaction-end-before-headers) #1543.
• Host-gateway/host.docker.internal bypass (configure_host_access_rules, lines 317-350) is scoped only to ports 80/443 plus explicitly allowed --allow-host-ports, not a blanket bypass.
• Host-level enforcement additionally uses the Docker DOCKER-USER iptables chain (src/host-iptables-rules.ts) as a second layer outside the container's own namespace.

Container Security (containers/agent/entrypoint.sh, 1664 lines):

• CAPS_TO_DROP="cap_sys_chroot,cap_sys_admin" dropped via capsh before user command execution when chroot mode is enabled (entrypoint.sh:433-434); comments confirm NET_ADMIN is never granted to the agent container at all — only the separate awf-iptables-init init container (sharing netns) gets it.
• seccomp profile (containers/agent/seccomp-profile.json) uses defaultAction: SCMP_ACT_ERRNO (default-deny) with only 5 explicit syscall rule groups allowed — a minimal, restrictive baseline.
• Selective bind mounts (per architecture docs) avoid a blanket host-filesystem mount; /etc/shadow and unwhitelisted home dirs are excluded.

Domain Validation (src/domain-validation.ts, src/domain-patterns.ts, src/squid/domain-acl.ts):

• SQUID_DANGEROUS_CHARS = /[\s\0"';#]/ plus a stricter backslash-inclusive check (checkDangerousChars) blocks whitespace, null bytes, quotes, semicolons, backticks, #(Squid comment char), and backslashes from reaching generatedsquid.conf` — this is the core Squid-config-injection prevention path and is well-isolated/documented.
• Wildcard-to-regex conversion (wildcardToRegex) deliberately uses a bounded character class ([a-zA-Z0-9.-]*) instead of .* specifically to prevent catastrophic-backtracking ReDoS — a subtle but important choice.
• Over-broad patterns (*, *.*, all-wildcard-and-dot patterns, and patterns where wildcard segments ≥ total−1) are explicitly rejected (checkOverBroadPattern, checkStructuralValidity) to stop meaningless "allow everything" allowlist entries.
• A second defense-in-depth assertion (assertSafeForSquidConfig in squid/domain-acl.ts) re-checks the dangerous-char regex immediately before interpolating a value into Squid config — belt-and-suspenders against a validation-bypass regression elsewhere in the call graph.

Input Validation / Injection Surfaces:

• No shell: true usage found anywhere under src/.
• All execa invocations found (src/container-lifecycle.ts, src/artifact-permissions.ts, src/artifact-preservation.ts) pass arguments as arrays (e.g. execa('docker', composeArgs, ...), execa.sync('chmod', ['-R', 'a+rX', targetDir])), which avoids shell-string interpolation/injection.
• Port-spec validation (is_valid_port_spec in setup-iptables.sh, mirrored by src/host-iptables-validation.ts) uses a fail-closed anchored regex and is documented as validated twice (TypeScript pre-validation + bash re-validation) — a good pattern for env-var-to-shell-command boundaries.

⚠️ Threat Model (STRIDE)

Category	Threat	Evidence	Likelihood	Impact
Spoofing	Malicious workflow instructs agent to impersonate legit administrative action (prompt injection)	escape-test-summary.txt: "Secret Digger" task attempted this; agent refused via noop	Medium (recurring pattern in untrusted workflow content)	Low (mitigated by agent policy + detection layer)
Tampering	Squid config injection via crafted --allow-domains/--allow-urls value	domain-validation.ts dangerous-char regex + double validation in domain-acl.ts	Low (well-mitigated)	High if bypassed (arbitrary Squid directive injection)
Repudiation	Firewall bypass attempts not logged	iptables LOG rules present for dangerous ports and default-deny drops (setup-iptables.sh:466-482); full iptables-save audit dump written to /tmp/awf-init/iptables-audit.txt	Low	Medium
Information Disclosure	Agent container reads host secrets/env via /proc or bind mounts	procfs mounted with hidepid=2; /etc/shadow and unwhitelisted $HOME dirs excluded from bind mounts (per architecture docs)	Low	High if bypassed
Denial of Service	ReDoS via crafted wildcard domain pattern	wildcardToRegex uses bounded char class [a-zA-Z0-9.-]* instead of .*, explicitly to avoid catastrophic backtracking	Low (mitigated)	Medium
Elevation of Privilege	Agent escapes chroot/gains host capabilities	cap_sys_chroot/cap_sys_admin dropped before user code runs; NET_ADMIN never granted to agent container	Low	Critical if bypassed

🎯 Attack Surface Map

Surface	Entry Point	Protections	Potential Weakness
Network egress	containers/agent/setup-iptables.sh (NAT/FILTER chains)	DNAT to Squid, default-deny FILTER DROP, dangerous-port blacklist, IPv6 disabled	Relies on init container completing setup before agent's first packet (mitigated by /tmp/awf-init/ready signal-file wait, per docs)
Container isolation	containers/agent/entrypoint.sh:426-440	Capability drop, seccomp default-deny, selective bind mounts	Chroot-mode-only cap drop — non-chroot mode explicitly does not drop these caps (entrypoint.sh:436-440), by design but worth confirming chroot mode is the expected default posture for untrusted workloads
Domain/URL parsing	src/domain-validation.ts, src/squid/domain-acl.ts	Dangerous-char rejection, over-broad-pattern rejection, ReDoS-safe regex construction, double validation	None identified — well-tested (multiple dedicated .test.ts files: domain-validation-branches.test.ts, squid-config-domains.test.ts, etc.)
CLI input handling	src/container-lifecycle.ts, src/artifact-*.ts	Array-form execa calls (no shell interpolation)	None identified in files reviewed
API proxy sidecar	containers/api-proxy/	Credential injection isolated from agent; extensive test coverage (auth-matrix, token-guards, oidc providers)	Not deeply reviewed in this pass (large surface, ~90 files) — recommend a dedicated follow-up review if time permits

📋 Evidence Collection

Commands run

cat /tmp/gh-aw/escape-test-summary.txt
wc -l src/host-iptables.ts containers/agent/setup-iptables.sh src/squid-config.ts
find src -iname "*domain*"
cat src/host-iptables.ts src/squid-config.ts   # both are thin re-export modules
cat src/domain-patterns.ts src/domain-validation.ts src/squid/domain-acl.ts
view containers/agent/setup-iptables.sh (full, 536 lines)
grep -n "capsh|SYS_CHROOT|SYS_ADMIN|chroot|NET_ADMIN|NET_RAW" containers/agent/entrypoint.sh
grep -n "execa|spawn(" src/*.ts
grep -rn "shell: true" src/
python3: seccomp-profile.json -> defaultAction SCMP_ACT_ERRNO, 5 syscall rule groups
npm audit --json -> 0 vulnerabilities (info/low/moderate/high/critical all 0)
find src -name "*.test.ts" | wc -l -> 270

✅ Recommendations

• High: No high-priority code fixes identified in this pass. Consider a dedicated deep-dive review of the containers/api-proxy/ sidecar (largest unreviewed surface, handles real credentials for OpenAI/Anthropic/Copilot/Gemini via OIDC token providers) since it was only lightly sampled here.
• Medium: Document/confirm whether non-chroot mode (which does not drop cap_sys_chroot/cap_sys_admin, per entrypoint.sh:436-440) is ever used for untrusted-command execution paths, or is strictly a trusted/legacy fallback — clarify in docs/environment.md if not already explicit.
• Medium: Continue monitoring the "Secret Digger" prompt-injection detection pattern (issue [aw] Detection Runs #6205 tracking) — the detector correctly flagged threat_detected even though the agent refused; ensure the tracking-issue workflow doesn't get noisy/ignored over time as these are expected refusals.
• Low: The seccomp profile has only 5 syscall rule entries with a default-deny action — periodically re-verify this list against agent tool requirements (e.g., new runtime dependencies) so legitimate syscalls aren't silently broken as the agent's supported toolset grows.
• Low: Consider adding a short comment/doc note next to DANGEROUS_PORTS in setup-iptables.sh cross-referencing the mirrored list (if any) in host-level src/host-iptables-rules.ts, to keep both layers in sync as new dangerous ports are identified.

📈 Security Metrics

• Security-critical files/lines analyzed: setup-iptables.sh (536), entrypoint.sh (1664, capability/seccomp sections), domain-patterns.ts (137), domain-validation.ts (124), squid/domain-acl.ts (100), squid/config-generator.ts (194), host-iptables-rules.ts (340), seccomp-profile.json (414) — ~3,500+ lines reviewed.
• Attack surfaces enumerated: 5 (network egress, container isolation, domain/URL parsing, CLI input handling, API proxy sidecar).
• STRIDE coverage: all 6 categories addressed with at least one evidence-backed finding.
• Dependency vulnerabilities: 0 (npm audit, all severities).
• Existing test files supporting security-critical code: 270 total in src/, with dedicated files for domain validation, ReDoS, and Squid config injection.

Generated by Daily Security Review and Threat Modeling · auto · 53.3 AIC · ⊞ 10.8K · ◷

• expires on Aug 24, 2026, 7:19 AM UTC