[Security Review] Security Review & Threat Model — 2026-07-08

[github-actions[bot]]

Executive Summary

The gh-aw-firewall codebase demonstrates a strong defense-in-depth posture: network isolation (iptables + Squid L7 proxy), container hardening (selective bind-mounts, capability drops, seccomp), and solid input validation. No critical or high vulnerabilities were found. Three medium-severity findings deserve attention: (1) AppArmor is set to unconfined due to procfs mount requirements, (2) mount and unshare syscalls are allowed in the seccomp profile while SYS_ADMIN is held during startup, and (3) the compose-sanitizer regex may miss some sensitive variable names.

Findings from the complementary Secret Digger workflow confirm the firewall is functioning correctly: GH_AW_SECRET_VERIFICATION_RESULT: success, GH_AW_AGENT_CONCLUSION: success, agent produced only noop outputs (no exfiltration paths found).

Metric	Value
Security-critical LOC analyzed	~3,186
Attack surfaces identified	9
Critical findings	0
High findings	0
Medium findings	3
Low findings	4

---

Findings from Firewall Escape Test

Source: /tmp/gh-aw/escape-test-summary.txt (Secret Digger workflow run 24273493151, 2026-04-11)

The escape-test file contains the workflow conclusion metadata:

• GH_AW_AGENT_CONCLUSION: success — agent completed without triggering failure handlers
• GH_AW_SECRET_VERIFICATION_RESULT: success — secret-isolation checks passed
• GH_AW_INFERENCE_ACCESS_ERROR: false — no unauthorized inference API access detected
• GH_AW_LOCKDOWN_CHECK_FAILED: false — lockdown enforcement worked
• Agent produced only noop outputs — no exfiltration paths found

Interpretation: The adversarial Secret Digger agent was successfully sandboxed. No escape, credential theft, or exfiltration succeeded. This is consistent with the code-level analysis below.

---

Architecture Security Analysis

Network Security

Evidence: containers/agent/setup-iptables.sh (516 lines), src/host-iptables-rules.ts (340 lines)

Strengths:

• Dual enforcement: NAT DNAT redirects ports 80/443 to Squid; OUTPUT filter DROP as fallback (setup-iptables.sh:460)
• Dangerous ports blocked in both NAT and FILTER chains: SSH(22), SMTP(25), databases (3306/5432/6379/27017), RDP(3389), SMB(445) (setup-iptables.sh:72-87)
• IPv6 unconditionally disabled via sysctl net.ipv6.conf.all.disable_ipv6=1 (setup-iptables.sh:110) — prevents IPv6 bypass
• Docker embedded DNS DNAT rules preserved during flush/restore cycle (setup-iptables.sh:144)
• Rate-limited [FW_BLOCKED_TCP] / [FW_BLOCKED_UDP_AGENT] LOG rules provide audit trail
• Host-level FW_WRAPPER chain in DOCKER-USER prevents container-to-container and container-to-host escapes

Weakness — [LOW-1] Non-standard HTTP ports not routed through Squid:
Only ports 80 and 443 are DNAT'd to Squid. Outbound TCP on ports 8080, 8443, 8000, 9000 etc. hits the final OUTPUT DROP (blocked) but bypasses Squid domain ACL filtering. Risk is LOW because traffic is still blocked; it just gets a TCP reset instead of a Squid 403.

Weakness — [LOW-2] ICMP not explicitly blocked:
No iptables rules exist for ICMP in setup-iptables.sh. The final DROP rules only match -p tcp and -p udp, so ICMP to external hosts may succeed. This creates a theoretical ICMP tunneling / covert-channel path. Recommendation: iptables -A OUTPUT -p icmp -j DROP.

Container Security

Evidence: containers/agent/entrypoint.sh (1,381 lines), containers/agent/seccomp-profile.json, src/services/agent-service.ts (334 lines)

Strengths:

• NET_ADMIN never granted to agent — iptables setup done by separate awf-iptables-init container sharing only the network namespace (agent-service.ts:68-76)
• Dropped capabilities: NET_RAW, SYS_PTRACE, SYS_MODULE, SYS_RAWIO, MKNOD (agent-service.ts:78-86)
• no-new-privileges:true prevents setuid binary escalation (agent-service.ts:90)
• SYS_CHROOT and SYS_ADMIN dropped via capsh before user code runs (entrypoint.sh:1320)
• AWF_USER_UID=0 explicitly rejected (entrypoint.sh:30-34)
• workDir hidden under tmpfs overlay — agent cannot read docker-compose.yml containing secrets (agent-service.ts:37-52)
• Resource limits: mem_limit=6g, pids_limit=1000, cpu_shares=1024
• Seccomp default action SCMP_ACT_ERRNO; blocks ptrace, process_vm_readv/writev, kexec_*, reboot, module operations, pivot_root, keyctl

Weakness — [MEDIUM-1] AppArmor set to unconfined:
security_opt: ['apparmor:unconfined'] in agent-service.ts:92. This is intentional to allow mount(2) for procfs at /host/proc. However, the entire entrypoint runs without AppArmor confinement, removing one defense layer during the pre-capsh-drop window. Recommendation: Develop a custom AppArmor profile that allows only mount -t proc on /host/proc and blocks all other mount operations.

Weakness — [MEDIUM-2] mount and unshare allowed in seccomp while SYS_ADMIN is held:
The seccomp profile allows mount (for procfs) and unshare (for user namespace operations). During the entrypoint startup window, the process runs as root with SYS_ADMIN + mount + unshare simultaneously. The entrypoint is controlled code and the window is short, but this is an accepted risk that should be explicitly documented. SYS_ADMIN is confirmed dropped before user code executes.

Note — fanotify_init allowed [LOW-3]: fanotify can monitor all filesystem access events. While it does not grant write access and secrets are protected by tmpfs overlays, it is worth reviewing whether any legitimate tool needs this capability.

Domain Validation

Evidence: src/domain-validation.ts (124 lines), src/domain-patterns.ts (137 lines)

Strengths:

• Squid injection prevention: SQUID_DANGEROUS_CHARS = /[\s\0"'\;#]/ catches whitespace, null bytes, quotes, semicolons, backticks, hashes (domain-validation.ts:22`)
• Backslash additionally rejected for domain names (domain-validation.ts:30)
• Over-broad wildcards *, *.*, and all-wildcard/dot patterns rejected (domain-validation.ts:55-70)
• Double-dots and lone dots rejected (domain-validation.ts:74-80)
• Wildcard-to-regex uses [a-zA-Z0-9.-]* (not .*) to prevent ReDoS (domain-patterns.ts:52)
• Results anchored with ^ and $ to prevent partial matches (domain-patterns.ts:99)
• Protocol-specific allowlisting (http-only vs https-only) per domain

No significant weaknesses found in domain validation.

Input Validation & Secrets Handling

Evidence: src/redact-secrets.ts, src/upstream-proxy.ts, src/compose-sanitizer.ts, src/dlp.ts

Strengths:

• redactSecrets() strips Bearer tokens, env vars with TOKEN/SECRET/KEY/PASSWORD/AUTH, and GitHub token prefixes from logged output
• compose-sanitizer.ts redacts TOKEN|KEY|SECRET env vars in docker-compose YAML before logging
• Upstream proxy credentials (user:pass@) rejected with error (upstream-proxy.ts:65)
• DLP Squid url_regex ACLs block GitHub tokens (ghp_, gho_, ghs_, ghu_, github_pat_), OpenAI keys (sk-, sk-proj-), and Anthropic keys from appearing in URLs
• All execa calls use array form — no shell injection risk

Weakness — [MEDIUM-3] compose-sanitizer regex may miss some sensitive variables:
/(TOKEN|KEY|SECRET)/i at compose-sanitizer.ts:4 does not match CREDENTIALS, BEARER, AUTH, _CERT, _PEM. Variables like ANTHROPIC_AUTH, COPILOT_BEARER, or GOOGLE_APPLICATION_CREDENTIALS (the last one actually contains CREDENTIALS not KEY) could appear in redacted logs. Recommendation: Expand to /(TOKEN|KEY|SECRET|CREDENTIALS?|BEARER|AUTH|_CERT|_PEM)/i.

Note — [LOW-4] redactSecrets() is best-effort: The function is a logging aid only; it does not cover all possible env variable names or stack traces. This is acceptable since the primary secret protection is the tmpfs workDir overlay.

---

Threat Model (STRIDE)

Category	Threat	Likelihood	Impact	Status
Spoofing	Agent runs as root via AWF_USER_UID=0	Very Low	Critical	Mitigated (entrypoint.sh:30)
Spoofing	DNS poisoning to redirect allowed domains	Very Low	High	Mitigated (DNS locked to 127.0.0.11)
Tampering	Agent reads/modifies docker-compose.yml (secrets)	Very Low	Critical	Mitigated (workDir tmpfs overlay)
Tampering	Agent manipulates iptables (requires NET_ADMIN)	Very Low	Critical	Mitigated (NET_ADMIN never granted)
Tampering	Agent mounts filesystems (SYS_ADMIN + mount syscall)	Low	High	MEDIUM-2 (short window, controlled code)
Repudiation	Agent makes HTTP requests with no audit trail	Very Low	Medium	Mitigated (Squid + iptables LOG rules)
Info Disclosure	Agent reads /proc/[pid]/environ of other procs	Low	High	Mitigated (hidepid=2 on procfs)
Info Disclosure	Agent reads CA private key (SSL Bump mode)	Low	High	Mitigated (tmpfs, mode 0700)
Info Disclosure	ICMP covert channel / tunneling	Low	Low	LOW-2 (no explicit ICMP block)
Info Disclosure	Sensitive env var leaked via compose logs	Low	Medium	MEDIUM-3 (sanitizer gaps)
DoS	Agent exhausts memory or PIDs	Low	Medium	Mitigated (mem_limit=6g, pids_limit=1000)
Elevation of Privilege	Escape via ptrace	Very Low	Critical	Mitigated (SYS_PTRACE dropped, seccomp blocks ptrace)
Elevation of Privilege	Load kernel module	Very Low	Critical	Mitigated (SYS_MODULE dropped, init_module blocked)
Elevation of Privilege	AppArmor bypass (AppArmor unconfined)	Low	Medium	MEDIUM-1 (no profile = no confinement)
Elevation of Privilege	setuid binary privilege escalation	Very Low	High	Mitigated (no-new-privileges:true)
Elevation of Privilege	Container escape via namespace tricks	Very Low	Critical	Mitigated (SYS_PTRACE/SYS_MODULE dropped, seccomp blocks kexec_*/pivot_root)

---

Attack Surface Map

Surface	Entry Point (file:line)	Current Protections	Risk
Network egress HTTP/HTTPS	setup-iptables.sh:371-372	DNAT to Squid; domain ACL; DLP url_regex	Low
Network egress non-standard ports	setup-iptables.sh:460	OUTPUT DROP (generic); not Squid-filtered	Low
Network egress ICMP	(no rule)	Falls through tcp/udp DROP; ICMP unchecked	Low
Domain allowlist injection	domain-validation.ts:22	5-step validation; dangerous chars, over-broad patterns	Very Low
Container filesystem access	agent-service.ts:37-52	Selective bind mounts; tmpfs overlays; no /etc/shadow	Very Low
Capability abuse (SYS_ADMIN window)	entrypoint.sh:1320 + agent-service.ts:92	AppArmor unconfined; mount in seccomp; short window	Low
Secret exfiltration via URL	dlp.ts + squid/config-generator.ts:55	DLP url_regex blocks known token prefixes in URLs	Low
Upstream proxy chaining	upstream-proxy.ts:65	Credentials rejected; loopback rejected; URL().parse validation	Very Low
API proxy credential injection	agent-service.ts:275	Sidecar cap_drop:ALL; agent never sees real key	Very Low

---

Recommendations

Critical

None identified.

High

None identified.

Medium

1. [MEDIUM-1] Custom AppArmor profile instead of unconfined (src/services/agent-service.ts:92)
   Create a minimal AppArmor profile that permits mount -t proc on /host/proc only, denying all other mount operations. This restores AppArmor as a confinement layer during the entrypoint startup window.

2. [MEDIUM-2] Document or narrow mount/unshare seccomp window (containers/agent/seccomp-profile.json)
   If technically feasible, re-exec the process with a tighter seccomp profile after the procfs mount completes. If not, add explicit comments documenting the accepted risk window, mitigating factors (controlled code, brief duration, SYS_ADMIN drop timing), and the threat scenario being accepted.

3. [MEDIUM-3] Expand compose-sanitizer regex (src/compose-sanitizer.ts:4)
   Change from /(TOKEN|KEY|SECRET)/i to /(TOKEN|KEY|SECRET|CREDENTIALS?|BEARER|AUTH|_CERT|_PEM)/i to catch a broader set of sensitive variable naming conventions.

Low

4. [LOW-1] Redirect non-standard HTTP ports through Squid (containers/agent/setup-iptables.sh)
   Add DNAT rules for common alternate HTTP ports (8080, 8443, 8000, 9000) so their traffic passes through Squid domain ACL filtering rather than a generic DROP.

5. [LOW-2] Explicitly block ICMP (containers/agent/setup-iptables.sh)
   Add iptables -A OUTPUT -p icmp -j DROP (with a rate-limited LOG rule) after the existing filter rules to eliminate the ICMP covert-channel theoretical attack surface.

6. [LOW-3] Review fanotify_init seccomp allowance (containers/agent/seccomp-profile.json)
   If no legitimate runtime tool requires fanotify filesystem monitoring, move fanotify_init to the blocked list.

7. [LOW-4] Clarify redactSecrets() scope (src/redact-secrets.ts)
   Add a code comment clarifying this is a logging aid only; document that primary secret protection comes from the tmpfs workDir overlay and no-new-privileges:true.

---

Security Metrics

Metric	Value
Security-critical source files analyzed	9
Security-critical LOC analyzed	3,186
Attack surfaces enumerated	9
STRIDE categories assessed	6
Threats modeled	16
Threats fully mitigated	13
Open findings	7 (3 medium, 4 low)
Critical / High vulnerabilities	0
Escape test result	success (no exfiltration)

---

Conducted by GitHub Copilot security analysis workflow — 2026-07-08. Analysis based on static code review of the gh-aw-firewall repository at HEAD, cross-referenced with Secret Digger workflow run 24273493151.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by Daily Security Review and Threat Modeling · 105.5 AIC · ⊞ 6.5K · ◷

• expires on Jul 15, 2026, 7:51 AM UTC

[github-actions[bot]]

🔮 The ancient spirits stir, and the smoke test agent was here.

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

• awmgmcpg
• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

[github-actions[bot]]

🔮 The ancient spirits stir. The smoke test agent was here, and the branch speaks of a clean pass.

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

• awmgmcpg
• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

[github-actions[bot]]

🔮 The ancient spirits stir; the smoke test agent was here, and the signs were favorable.

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

• awmgmcpg
• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

[github-actions[bot]]

🔮 The ancient spirits stir, and the smoke test agent has walked this thread. The GitHub GitHub test passed in quiet alignment.

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

• awmgmcpg
• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

[github-actions[bot]]

🔮 The ancient spirits stir; the smoke test agent was here, and the firewall remains watched.

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

• awmgmcpg
• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

[github-actions[bot]]

🔮 The ancient spirits stir... the smoke-test agent passed through this discussion and left this omen of verification.

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

• awmgmcpg
• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}