[Security Review] Daily Security Review — AWF Firewall Threat Model & Attack Surface Analysis

[github-actions[bot]]

📊 Executive Summary

Multi-layered, defense-in-depth architecture. Overall posture: good. Primary risks are design trade-offs (SYS_ADMIN window, apparmor:unconfined, opt-in DLP) and missing protections (unshare syscall, port-list gaps). No exploitable critical vulnerabilities found. The firewall escape test (Secret Digger workflow) concluded with GH_AW_SECRET_VERIFICATION_RESULT: success and noop outputs — zero secrets exfiltrated.

Scope: 380 files · 2,599 security-critical lines in 5 core files · 8 attack surfaces · 12 STRIDE scenarios

---

🛡️ Architecture Security Analysis

Network Layer

Two independent enforcement layers:

Layer	Mechanism	File
L7	Squid ACL domain whitelist	src/squid/config-generator.ts
L4 host	DOCKER-USER chain	src/host-iptables-rules.ts
L4 agent	OUTPUT DNAT → Squid	containers/agent/setup-iptables.sh

Strengths: IPv6 disabled in agent namespace (line 109), default-deny OUTPUT chain (line 459), 15 dangerous ports LOG+DROP, Docker DNS rules preserved before NAT flush.

⚠️ Gap: Dangerous ports list (setup-iptables.sh:72–88) missing: 8080, 8443, 9090, 5984, 9200, 11211, 9042, 2181, 6443.

---

Container Security

Capability configuration (src/services/agent-service.ts:68–92):

• cap_add: ['SYS_CHROOT', 'SYS_ADMIN'] — both dropped by capsh before user code runs
• cap_drop: ['NET_RAW', 'SYS_PTRACE', 'SYS_MODULE', 'SYS_RAWIO', 'MKNOD']
• security_opt: ['no-new-privileges:true', 'seccomp=...', 'apparmor:unconfined']
• NET_ADMIN isolated to init container only — never granted to agent
• pids_limit: 1000, mem_limit: 6g

Seccomp profile (containers/agent/seccomp-profile.json): Default SCMP_ACT_ERRNO. Blocks ptrace, process_vm_readv/writev, kexec_*, init_module, pivot_root, keyctl, add_key, request_key (29 syscalls total).

Token protection: Three-layer defense — LD_PRELOAD one-shot-token.so (caches tokens in-process), unset_sensitive_tokens() (14 vars unset), hidepid=2 on procfs (blocks PID-1 environ reads).

tmpfs overlays: workdir (hides docker-compose.yml secrets), MCP logs, /dev/shm.

---

⚠️ Key Weaknesses Found

H1. unshare syscall allowed in seccomp (High)

Verified in containers/agent/seccomp-profile.json: unshare → SCMP_ACT_ALLOW.

On Ubuntu 22.04 (agent base), kernel.unprivileged_userns_clone=1 by default. An unprivileged awfuser can call unshare --user to obtain a user-namespace root mapping — a known container isolation weakening. clone and clone3 are also allowed.

H2. apparmor:unconfined + SYS_ADMIN startup window (High)

Between container start and capsh --drop in entrypoint.sh:401, the process runs as root with SYS_ADMIN AND apparmor:unconfined. The mount syscall is explicitly allowed in seccomp (needed for procfs). This is intentional but represents the highest-privilege window in the system (~1–2 seconds).

M1. DLP credential scanning is opt-in (Medium)

src/dlp.ts covers GitHub, OpenAI, Anthropic, AWS, and Google API tokens. Default is off; requires --enable-dlp. Given these are exactly the credentials agents use, silent credential leakage via URLs is possible without enabling it.

M2. No hidepid=2 in non-chroot mode (Medium)

hidepid=2 is applied via mount_host_procfs() only in chroot mode (entrypoint.sh:521). The non-chroot path (run_non_chroot_command) uses the standard container proc — the token timing window (~1s between agent start and unset_sensitive_tokens) is unprotected by hidepid there.

L1. Unquoted $rule variable in iptables restore (Low)

containers/agent/setup-iptables.sh:159: iptables -t nat $rule expands unquoted from iptables-save output. Low risk (source requires host root to tamper) but poor hygiene.

---

⚠️ Threat Model (STRIDE)

Threat	Location	Likelihood	Impact	Rating
unshare --user user-namespace root	seccomp allows unshare	Medium	High	🔴 High
SYS_ADMIN+AppArmor:unconfined pre-capsh	agent-service.ts:76,92	Very Low	High	🟡 Low
Token leakage via /proc/1/environ race	entrypoint.sh:415–488	Low (hidepid=2)	Critical	🟡 Medium
Credential leak via URL (DLP off by default)	src/dlp.ts	Medium	High	🟠 Medium
Squid config injection via --allow-domains	src/domain-validation.ts	Very Low (validated)	High	🟢 Mitigated
Agent reaches non-listed dangerous ports	setup-iptables.sh:72–88	Low	Medium	🟡 Low
Repudiation (no request attribution)	Squid logs + iptables audit	Low	Medium	🟡 Low
docker-compose.yml readable before tmpfs	agent-service.ts:43–48	Very Low	High	🟡 Low

---

✅ Recommendations

🔴 High

H1. Block unshare in seccomp profile

{ "names": ["unshare"], "action": "SCMP_ACT_ERRNO" }

Add to containers/agent/seccomp-profile.json. Note: may break tools using Bubblewrap/user namespaces for sandboxing.

H2. Narrow AppArmor profile

Replace apparmor:unconfined with a custom profile permitting only mount proc /host/proc — eliminates the AppArmor+SYS_ADMIN window risk class.

🟠 Medium

M1. Enable DLP by default — flip enableDlp default to true, add --disable-dlp opt-out.

M2. Expand dangerous ports list — add 8080, 8443, 9090, 5984, 9200, 11211, 9042, 2181, 6443 to DANGEROUS_PORTS in setup-iptables.sh.

M3. Apply hidepid=2 in non-chroot mode — add mount -o remount,hidepid=2 /proc in run_non_chroot_command() before privilege drop.

M4. Quote iptables variable expansion — setup-iptables.sh:159: use eval "iptables -t nat $rule" or prefer iptables-restore for rule reapplication.

🟡 Low

L1. Pin ubuntu/squid base image to a digest in containers/squid/Dockerfile.

L2. Validate DNS IPs with is_valid_ipv4 before use in iptables rules (setup-iptables.sh:236).

L3. Consider blocking clone+CLONE_NEWUSER flag via seccomp arg filtering for additional namespace hardening.

---

📈 Security Metrics

Metric	Value
Files reviewed	380
Exploitable critical vulnerabilities	0
High-severity findings	2
Medium findings	4
Seccomp blocked syscalls (default deny)	29
Capabilities added+dropped before user code	2 (SYS_ADMIN, SYS_CHROOT)
Capabilities dropped at start	5 (NET_RAW, SYS_PTRACE, SYS_MODULE, SYS_RAWIO, MKNOD)
DLP patterns (opt-in)	10+
Escape test result	No secrets found

Generated by Daily Security Review and Threat Modeling · 144.8 AIC · ⊞ 7K · ◷

• expires on Jul 8, 2026, 1:22 PM UTC

[github-actions[bot]]

🔮 The ancient spirits stir; the smoke test agent was here.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

[github-actions[bot]]

🔮 The ancient spirits stir, and the smoke test agent was here.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

[github-actions[bot]]

🔮 The ancient spirits stir, and the smoke test has walked this repository. The firewall held, the build rose cleanly, and the omens are favorable.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

[github-actions[bot]]

🔮 The ancient spirits stir, and the smoke test agent has passed through the firewall.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

[github-actions[bot]]

🔮 The ancient spirits stir; the smoke test agent was here.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

[github-actions[bot]]

🔮 The ancient spirits stir; the smoke test agent was here, and the omens remain favorable.

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

• awmgmcpg
• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-07-08T13:22:37.504Z.

Closed by Workflow

[github-actions[bot]]

🔮 The ancient spirits stir: the smoke test agent passed through the firewall and leaves this oracle-marked trace.

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

• awmgmcpg
• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}