[Security Review] 🔐 Daily Security Review & Threat Model — gh-aw-firewall (2026-07-13)

[github-actions[bot]]

📊 Executive Summary

This security review covers a deep, evidence-based analysis of the gh-aw-firewall (awf) codebase — a sandboxed Docker network firewall for AI agents providing L7 HTTP/HTTPS egress filtering via Squid proxy with iptables enforcement.

Overall security posture: STRONG with a well-layered defense-in-depth architecture. The codebase demonstrates mature security engineering: input validation, capability minimization, network isolation, and audit logging. Several medium-risk architectural nuances are worth tracking.

Metric	Value
Security-critical files analyzed	427 source files (TypeScript + Shell)
Total lines of security-critical code	~63,400
Attack surfaces identified	8
Critical findings	0
High findings	1
Medium findings	4
Low findings	3

---

🔍 Findings from Firewall Escape Test

The pre-fetched escape test summary file (/tmp/gh-aw/escape-test-summary.txt) was empty — no prior escape test data was available in this run. The threat model below is based entirely on static code analysis.

---

🛡️ Architecture Security Analysis

Network Security Assessment

Defense-in-depth layering (strong):

1. L7 (Squid): Domain ACL whitelisting with dstdomain and dstdom_regex. Both HTTP and HTTPS traffic is filtered. Raw IP CONNECT is explicitly blocked (acl dst_ipv4 dstdom_regex, acl dst_ipv6 dstdom_regex).
2. L3/L4 (iptables DNAT): All port 80/443 TCP is redirected to Squid inside the agent network namespace. Non-HTTP protocols default to DROP.
3. Host iptables chain: FW_WRAPPER chain at the Docker bridge level blocks outbound traffic not destined to allowed DNS or the Squid proxy.

Evidence — DNAT redirect rules (containers/agent/setup-iptables.sh):

iptables -t nat -A OUTPUT -p tcp --dport 80 -j DNAT --to-destination "${SQUID_IP}:${SQUID_PORT}"
iptables -t nat -A OUTPUT -p tcp --dport 443 -j DNAT --to-destination "${SQUID_IP}:${SQUID_PORT}"

Evidence — IPv6 disabled (prevents proxy bypass via IPv6 Happy Eyeballs):

sysctl -w net.ipv6.conf.all.disable_ipv6=1

Gap — Proxy-unaware HTTPS tools (⚠️ Medium):
Proxy-unaware tools whose port 443 traffic is DNAT'd to Squid receive a TLS handshake rejection (Squid expects CONNECT), not a clean 403. Traffic is still blocked, but the error mode is a TLS error rather than an explicit deny. This is acceptable by design but could confuse agent error-handling.

Gap — Non-TCP/UDP protocols (i️ Low):
ICMP and raw IP traffic are not explicitly DROP'd in the agent container's OUTPUT chain. However, MKNOD and NET_RAW capabilities are dropped, making raw socket creation very difficult. Risk is low but acknowledged.

Dangerous ports blocked (strong):

22 (SSH), 23 (Telnet), 25 (SMTP), 110 (POP3), 143 (IMAP), 445 (SMB),
3306 (MySQL), 5432 (PostgreSQL), 6379 (Redis), 27017-27018 (MongoDB)

Both at iptables NAT level (RETURN → DROP) and in Squid Safe_ports validation.

---

Container Security Assessment

Capability inventory (evidence from src/services/agent-service.ts line 77-93):

Capability	Status	Justification
SYS_CHROOT	Added, then dropped via capsh	Required for chroot to /host
SYS_ADMIN	Added, then dropped via capsh	Required for procfs mount (/host/proc)
NET_ADMIN	NOT granted to agent	Only iptables-init container gets this
NET_RAW	Dropped	Prevents raw socket creation
SYS_PTRACE	Dropped	Prevents container escape via process inspection
SYS_MODULE	Dropped	Prevents kernel module loading
SYS_RAWIO	Dropped	Prevents raw I/O
MKNOD	Dropped	Prevents device node creation

⚠️ HIGH — AppArmor explicitly set to unconfined (src/services/agent-service.ts line 93):

security_opt: [
  'no-new-privileges:true',
  'apparmor:unconfined',
  `seccomp=${config.workDir}/seccomp-profile.json`,
]

AppArmor is disabled because SYS_ADMIN is needed to mount procfs, and Docker's default AppArmor profile blocks mount. While SYS_ADMIN is dropped via capsh before user code runs, the window between container start and capsh execution runs with apparmor:unconfined and SYS_ADMIN active. Any vulnerability in the entrypoint script during this window would have no AppArmor containment.

Recommendation: Consider a custom AppArmor profile that allows only the specific mount operations needed rather than full unconfined.

Seccomp profile (strong):

• 5 syscall groups: large allowlist (standard operations), small extra group (kcmp, pidfd_getfd), ptrace/process_vm_readv/process_vm_writev blocked with SCMP_ACT_ERRNO.
• Critical syscalls explicitly denied: kexec_load, kexec_file_load, reboot, init_module, finit_module, delete_module, pivot_root, syslog, keyctl, name_to_handle_at.
• Note: mount and unshare are in the ALLOW list (required for entrypoint procfs setup). These are high-risk syscalls — after SYS_ADMIN is dropped by capsh, mount calls will fail at the kernel permission check, providing a second layer of defense.

Procfs isolation (strong):

/host/proc mounted with hidepid=2

Prevents agent from reading other processes' /proc/[pid]/environ which could contain credentials.

---

Domain Validation Assessment

Input validation (strong) — src/domain-validation.ts:

Five-layer validation chain:

1. Empty-input check
2. Dangerous character detection (SQUID_DANGEROUS_CHARS = /[\s\0"'\'\;#]/`) — blocks Squid config injection
3. Domain-specific dangerous chars — additionally blocks \\ (backslash)
4. Over-broad pattern detection (*, *.*, [*.]+-only patterns)
5. Structural validity (double dots, lone dot, multi-wildcard segments)

Wildcard-to-regex conversion (src/squid/config-generator.ts):

// Uses character class instead of .* to prevent catastrophic backtracking (ReDoS)
const DOMAIN_CHAR_PATTERN = '[a-zA-Z0-9.-]*';

ReDoS protection is implemented. * wildcards are converted to bounded character classes, not .*.

⚠️ Medium — Squid dstdomain .github.com matches evilgithub.com:
Squid's dstdomain ACL type matches both github.com exactly and any subdomain like .github.com. However, it does NOT match evilgithub.com because dstdomain matches by suffix from a dot boundary. This behavior is correct — Squid's dstdomain is dot-boundary aware. ✅ No actual vulnerability; this is a clarification.

---

Input Validation Assessment

CLI argument injection (strong):

• execa is used (not exec with shell interpolation) — arguments are passed as arrays, preventing shell injection.
• Domain names validated before entering Squid config generation.
• UID/GID validated as numeric and non-zero before usermod/groupmod in entrypoint.

⚠️ Medium — AWF_CLI_PROXY_URL shell interpolation (containers/agent/entrypoint.sh):

CLI_PROXY_HOST=$(echo "$AWF_CLI_PROXY_URL" | sed -E 's|^https?://([^:/]+).*|\1|')
CLI_PROXY_PORT=$(echo "$AWF_CLI_PROXY_URL" | sed -E 's|^https?://[^:]+:([0-9]+).*|\1|')
timeout 5 bash -c "cat < /dev/null > /dev/tcp/${CLI_PROXY_HOST}/${CLI_PROXY_PORT}"

The bash -c with ${CLI_PROXY_HOST} and ${CLI_PROXY_PORT} interpolated into a string creates a potential injection risk if AWF_CLI_PROXY_URL contains shell metacharacters. Since this env var is set by the CLI (not user input), the risk is low, but the pattern is unsafe.

Recommendation: Validate CLI_PROXY_HOST as a valid IPv4 address and CLI_PROXY_PORT as a number before the bash -c invocation.

---

⚠️ Threat Model (STRIDE)

STRIDE Category	Threat	Likelihood	Impact	Notes
Spoofing	Agent spoofs Squid proxy IP via ARP poisoning on awf-net	Very Low	High	Fixed network topology (172.30.0.0/24), containers don't get NET_ADMIN
Spoofing	DNS spoofing to redirect allowed domains to malicious IPs	Low	High	DNS servers are restricted; Docker embedded DNS used
Tampering	Agent modifies squid.conf in Squid container	Very Low	Critical	Squid config passed via env var (base64), not file mount; agent can't reach Squid container FS
Tampering	Agent writes to host filesystem via bind mount escape	Low	High	chroot to /host with selective bind mounts; /etc/shadow excluded; SYS_ADMIN dropped before user code
Repudiation	Agent denies network activity	Low	Medium	Squid logs all requests with timestamps, client IPs; iptables LOG rules for blocked traffic
Information Disclosure	Agent reads other container's /proc/[pid]/environ	Very Low	High	hidepid=2 on procfs; separate network namespaces
Information Disclosure	API keys leaked in agent env	Very Low	Critical	API proxy sidecar pattern isolates credentials; keys not in agent environment
Information Disclosure	Credentials in URLs (DLP bypass)	Low	High	DLP module scans URL patterns; opt-in --enable-dlp flag
Denial of Service	Agent floods Squid with requests	Low	Medium	pids_limit set; mem_limit set; Squid has client_lifetime 8 hours
Denial of Service	Agent exhausts host iptables connections	Low	Medium	conntrack table limits apply; no explicit mitigation
Elevation of Privilege	Exploit entrypoint before capsh drops SYS_ADMIN	Low	High	apparmor:unconfined window is the main concern; mitigated by seccomp
Elevation of Privilege	unshare syscall to create new user namespace	Medium	High	unshare is in the seccomp ALLOW list; SYS_ADMIN is dropped by capsh before user code, but user namespaces may not require SYS_ADMIN in all kernel configurations

---

🎯 Attack Surface Map

Surface	Entry Point	Current Protections	Risk
CLI arguments	src/cli.ts	Domain validation, dangerous char rejection, execa array args	Low
Squid config generation	src/squid/config-generator.ts	Input sanitization, validateApiProxyIp(), port validation	Low
Agent network egress	containers/agent/setup-iptables.sh	DNAT redirect, dangerous port DROP, IPv6 disabled	Low-Med
Agent container escape	containers/agent/entrypoint.sh	Capability drop via capsh, chroot, seccomp, no-new-privileges	Med (AppArmor unconfined window)
Host iptables	src/host-iptables-rules.ts	Custom FW_WRAPPER chain, IPv6 disable fallback	Low
API proxy sidecar	containers/api-proxy/	Credential isolation, Squid upstream, network-isolated sidecar	Low
DNS	Docker embedded DNS → upstream	Restricted DNS servers, iptables DNS allowlist	Low
Docker socket (DinD)	--enable-dind flag	Optional, must be explicitly enabled	Med (if enabled)

---

📋 Evidence Collection

Key commands and outputs used in this review

Capability settings (src/services/agent-service.ts lines 77-93):

cap_add: ['SYS_CHROOT', 'SYS_ADMIN'],
cap_drop: ['NET_RAW', 'SYS_PTRACE', 'SYS_MODULE', 'SYS_RAWIO', 'MKNOD'],
security_opt: ['no-new-privileges:true', 'apparmor:unconfined', 'seccomp=...']

Seccomp profile — denied syscalls (containers/agent/seccomp-profile.json):

ptrace, process_vm_readv, process_vm_writev → SCMP_ACT_ERRNO
kexec_load, pivot_root, syslog, keyctl, init_module → SCMP_ACT_ERRNO
unshare, mount → SCMP_ACT_ALLOW (required for setup)

Domain validation dangerous chars (src/domain-validation.ts line ~25):

export const SQUID_DANGEROUS_CHARS = /[\s\0"'\`;#]/;

iptables dangerous ports (containers/agent/setup-iptables.sh):

DANGEROUS_PORTS=(22 23 25 110 143 445 3306 5432 6379 27017 27018 28017)

DLP patterns (src/dlp.ts): GitHub tokens (ghp_, gho_, ghs_, ghu_), Anthropic, OpenAI, AWS key patterns detected in URLs.

---

✅ Recommendations

🔴 Critical

None identified.

🟠 High

1. AppArmor unconfined window — The agent container runs apparmor:unconfined because SYS_ADMIN is needed for procfs mount. Consider authoring a narrow custom AppArmor profile that permits only the specific mount operations needed (procfs at /host/proc), then drops to a restricted profile before capsh drops capabilities. This eliminates the unconfined window.

🟡 Medium

2. unshare syscall allowed — unshare is in the seccomp ALLOW list. On kernels with unprivileged_userns_clone=1, an unprivileged user can create new user namespaces via unshare, which can be used to gain fake root inside the namespace and potentially escalate. Recommend adding unshare to SCMP_ACT_ERRNO or validating the target kernel's kernel.unprivileged_userns_clone sysctl is 0.

3. bash -c with interpolated $CLI_PROXY_HOST/$CLI_PROXY_PORT (entrypoint.sh) — Validate these values as strict IPv4 and numeric before the bash -c invocation, or use /dev/tcp via a direct bash builtin without string interpolation.

4. DLP is opt-in — The credential-in-URL DLP scanning (--enable-dlp) is not enabled by default. Recommend enabling by default with an opt-out, as credential leakage in URLs is a common AI agent mistake.

5. mount syscall allowed in seccomp — While SYS_ADMIN is dropped by capsh before user code, mount remains allowed in seccomp. If there's a way to call mount without CAP_SYS_ADMIN (some bind mounts in user namespaces), this could be exploited. Restrict mount in seccomp after the entrypoint completes (if runtime seccomp profile swapping is feasible).

🟢 Low

6. ICMP not explicitly blocked — Non-TCP/UDP protocols (ICMP) are not explicitly DROPped. While NET_RAW is dropped (preventing raw socket creation), ICMP ping is allowed. Consider a default-deny policy for all protocols, not just TCP/UDP.

7. forwarded_for delete and via off in Squid — These are set correctly. Verify these settings are not accidentally removed in future config changes (add to test coverage).

8. Log retention — Squid logs are written to a volume. Verify log rotation is in place to prevent disk exhaustion in long-running sessions.

---

📈 Security Metrics

Metric	Value
Lines of security-critical code analyzed	~63,400
Source files reviewed	427 (TypeScript + Shell)
Attack surfaces mapped	8
STRIDE threats modeled	12
Seccomp-blocked syscalls (groups)	2 deny groups (25+ syscalls)
Dangerous ports blocked	12
DLP credential patterns	6+ (GitHub, Anthropic, OpenAI, AWS)
Escape test data available	❌ (empty summary file)

---

Review generated: 2026-07-13T07:57:23Z | Reviewer: GitHub Copilot CLI (claude-sonnet-4.6) | Scope: full static analysis

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by Daily Security Review and Threat Modeling · 62.4 AIC · ⊞ 6.5K · ◷

• expires on Jul 20, 2026, 8:02 AM UTC

[github-actions[bot]]

🔮 The ancient spirits stir; the smoke test agent passed through and left this omen behind.

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

• awmgmcpg
• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

[github-actions[bot]]

🔮 The ancient spirits stir around this smoke test. A passing omen from Codex leaves this discussion blessed and observed.

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

• awmgmcpg
• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

[github-actions[bot]]

🔮 The ancient spirits stir; the smoke test agent was here.

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

• awmgmcpg
• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

[github-actions[bot]]

🔮 The ancient spirits stir, and the smoke test agent was here. The run was brief, the omens were green, and the GitHub winds carried only PASS.

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

• awmgmcpg
• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

[github-actions[bot]]

🔮 The ancient spirits stir: the smoke test agent was here, and the build omens were favorable.

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

• awmgmcpg
• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

[github-actions[bot]]

🔮 The ancient spirits stir, and the smoke test agent has walked this discussion. The omens are favorable.

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

• awmgmcpg
• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-07-20T08:02:51.094Z.

Closed by Workflow