[Security Review] Daily Security Review

[github-actions[bot]]

📊 Executive Summary

Security posture is solid: default-deny seccomp, no-new-privileges, NET_ADMIN confined to a separate init container, hidepid procfs, and credential isolation via the API proxy. No critical or high findings. This review was limited in depth (budget-bound sampling, not full line-by-line audit). npm audit could not run (registry TLS error in sandbox), so dependency CVEs are unverified.

🔍 Findings from Firewall Escape Test

/tmp/gh-aw/escape-test-summary.txt only contained workflow conclusion log lines for the "Secret Digger (Copilot)" run (29286879560): the agent refused the prompt and emitted a noop; threat detection raised a warning (threat_detected), tracked in #6205 (no-op tracked in #5883). No escape attempts or successes were recorded, so there is no result to cross-reference. Worth a human look at why detection warned.

🛡️ Architecture Security Analysis

• Network: Squid ACL default-deny; iptables set up by awf-iptables-init (src/services/agent-service.ts:309-352, cap_add: NET_ADMIN, NET_RAW, cap_drop: ALL), so the agent never holds NET_ADMIN. setup-iptables.sh (540 lines) restricts DNS and blocks dangerous ports.
• Container: agent cap_add: ['SYS_CHROOT','SYS_ADMIN'] (agent-service.ts:64) with no-new-privileges, custom seccomp (defaultAction: SCMP_ACT_ERRNO, seccomp-profile.json:2), and apparmor:unconfined (agent-service.ts:73-80). SYS_ADMIN/SYS_CHROOT are dropped with capsh before user code (entrypoint.sh).
• Domain validation: wildcard * patterns converted to Squid regex in src/domain-patterns.ts (137 lines).
• Input validation: user command is passed to chroot /host /bin/bash -c (entrypoint.sh:1763) by design (the user's own command); no shell eval of external input observed in sampled code.

⚠️ Threat Model (STRIDE)

Category	Threat	Evidence	Likelihood	Impact	Rating
Spoofing	Agent impersonates API proxy/Squid IP	fixed subnet 172.30.0.0/24	Low	Med	Low
Tampering	Agent edits workspace/tmp (rw by design)	bind mounts	Med	Low	Low
Repudiation	Non-HTTP blocked traffic only in kernel log	iptables LOG rules	Low	Low	Low
Info disclosure	Tokens in agent env if api-proxy disabled	CLAUDE.md design	Med	High	Medium (config-dependent)
DoS	Resource exhaustion	mem limit 6g, pids limits in compose	Low	Low	Low
EoP	Window while SYS_ADMIN held pre-capsh; AppArmor unconfined	agent-service.ts:64,80	Low	High	Medium
EoP	AWF_SKIP_CAP_DROP env removes cap_drop entries	src/capability-filter.ts:55-110	Low	Med	Low (host-operator controlled)

🎯 Attack Surface Map

Surface	Entry	Protections	Weakness / Risk
Network egress	Squid, setup-iptables.sh	domain ACL, DNAT fallback, port blocks	Proxy-unaware TLS blocked only via handshake fail; Low
Container	agent-service.ts:56-80	cap_drop, seccomp, NNP	SYS_ADMIN + AppArmor unconfined during startup; Medium
Domain parsing	domain-patterns.ts	normalization, regex conversion	Overbroad wildcards (user-supplied); Low
Input	src/cli.ts, entrypoint.sh:1763	execa arg arrays, intentional shell	Low
Docker wrapper	containers/agent/docker-wrapper.sh	not deeply reviewed	Unknown

📋 Evidence Collection

Commands and outputs

$ grep -rn "cap_drop\|cap_add\|NET_ADMIN" src/services/agent-service.ts
64: cap_add: ['SYS_CHROOT', 'SYS_ADMIN'],
66: cap_drop: ['NET_RAW','SYS_PTRACE','SYS_MODULE','SYS_RAWIO','MKNOD']
78: 'no-new-privileges:true'
351: cap_add: ['NET_ADMIN','NET_RAW'] (init container); 352: cap_drop: ['ALL']
$ grep -n defaultAction containers/agent/seccomp-profile.json
2: "defaultAction": "SCMP_ACT_ERRNO",
$ npm audit --omit=dev
npm error audit endpoint returned an error (self-signed certificate)

Note: src/host-iptables.ts is now a 10-line shim and src/squid-config.ts 2 lines (logic moved elsewhere), so those files were not analyzed in detail.

✅ Recommendations

• Critical: none.
• High: none.
• Medium: Consider replacing apparmor:unconfined with a custom profile permitting only the procfs mount; verify the startup window with SYS_ADMIN cannot be reached by user code. Run npm audit in CI with network access and review results.
• Low: Investigate the threat_detected warning ([aw] Detection Runs #6205); document AWF_SKIP_CAP_DROP risk and consider refusing it in strict mode; review docker-wrapper.sh and the refactored squid config modules in a follow-up.

📈 Security Metrics

• Files sampled: ~6 (≈3,000 lines incl. entrypoint 1837, setup-iptables 540, seccomp 414, domain-patterns 137)
• Attack surfaces identified: 5
• STRIDE coverage: 6/6 categories
• Limitations: escape-test data empty of attempts; npm audit unavailable.

Generated by Daily Security Review and Threat Modeling · copilot · auto · 20.8 AIC · ⊞ 10.8K · ◷

• expires on Oct 10, 2026, 1:57 PM UTC

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-10-10T13:57:58.103Z.

Closed by Workflow