[Security Review] Security Review — gh-aw-firewall (2026-06-27) #5600
Replies: 7 comments
-
|
🔮 The ancient spirits stir, and the smoke test agent was here. The omens are clear, the build is sound, and the run leaves a clean trail through the firewall.
|
Beta Was this translation helpful? Give feedback.
-
|
🔮 The ancient spirits stir above the repository waters. The smoke test agent has passed through, traced the omens, and left this sign in the astral log. Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "registry.npmjs.org"See Network Configuration for more information.
|
Beta Was this translation helpful? Give feedback.
-
|
🔮 The ancient spirits stir around this discussion. The smoke test agent was here, and the omens read as passed.
|
Beta Was this translation helpful? Give feedback.
-
|
🔮 The ancient spirits stir, and the smoke test agent was here. May the firewall hold, the paths stay true, and the build remain in favorable alignment. Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "registry.npmjs.org"See Network Configuration for more information.
|
Beta Was this translation helpful? Give feedback.
-
|
🔮 The ancient spirits stir: the smoke test agent was here, and the omens are favorable. Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "registry.npmjs.org"See Network Configuration for more information.
|
Beta Was this translation helpful? Give feedback.
-
|
🔮 The ancient spirits stir. The smoke test agent was here, and the omens are favorable. Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "registry.npmjs.org"See Network Configuration for more information.
|
Beta Was this translation helpful? Give feedback.
-
|
🔮 The ancient spirits have spoken: the smoke test agent passed through GitHub’s veil and returned in harmony. The omens are clear, the build was blessed, and the workflow stands affirmed. Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "registry.npmjs.org"See Network Configuration for more information.
|
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
-
📊 Executive Summary
AWF applies a well-designed layered security model: iptables DNAT → Squid L7 filtering → domain ACL → capability drops → seccomp → hidepid=2 procfs → one-shot token protection. No critical or high findings were identified. Five findings warrant attention (1 medium, 3 low, 1 informational).
🔍 Escape-Test Corroboration
The escape-test noop directly validates:
ANTHROPIC_API_KEY,GITHUB_TOKENnot accessible to agent/procbefore any exfiltration windowhidepid=2: cross-process credential reading blocked🛡️ Architecture Security Analysis
Network Security
Strengths: Triple-layer egress (iptables → Squid → ACL); IPv6 disabled via sysctl; direct-IP HTTPS blocked in Squid (
http_access deny dst_ipv4/dst_ipv6); 14-port dangerous-port blocklist at NAT;forwarded_for delete.Gaps: Dangerous-port NAT RETURN rules are IPv4-only; DNS UDP/53 to 8.8.8.8/8.8.4.4 allows query-name exfiltration.
Container Security
Strengths:
CAP_SYS_CHROOT+CAP_SYS_ADMINdropped viacapshbefore user code;NET_ADMINnever granted to agent; seccomp blocksptrace,process_vm_readv/writev,kexec_load,reboot,init_module,umount; procfs mounted withhidepid=2,nosuid,nodev,noexec; UID/GID=0 explicitly rejected;/etc/shadowexcluded; SSL Bump CA keys in tmpfs with secure-wipe on cleanup.Gaps: One-shot token protection silently disabled on Alpine/musl hosts; 1-second token-clearance timing window (mitigated by hidepid=2).
Domain & Input Validation
Strengths: Squid-injection chars rejected (
\s,\0,",',`,;,#,\); wildcard regex uses[a-zA-Z0-9.-]*(not.*) to prevent ReDoS; over-broad patterns (*,*.*) rejected; port specs validated in both TS and shell with shared test fixtures; CLI proxy usesexecFile(no shell).🔴 M-1 — Shell metacharacters pass through in
agentCommand(Medium)File:
src/services/agent-service.ts:146Only
$→$$is escaped (for Docker Compose YAML interpolation). Unquoted;,&&,||,`,>pass through tobash -c. Example:awf -- 'curl x.com; id'runs both commands.Blast radius is contained — the container runs as an unprivileged user post-cap-drop with seccomp active; no host-escape path. However, it is an injection surface for users crafting malicious AWF invocations.
Recommendation: Parse the command into argv via a shell-quote library and use the array form, eliminating
bash -cwrapping.🟡 L-1 — IPv6 disable sysctl silent failure; no ip6tables dangerous-port blocklist (Low)
File:
containers/agent/setup-iptables.sh:110–111Continues on failure with only a warning. If the sysctl fails, IPv6 remains enabled but the DANGEROUS_PORTS blocklist (
iptablesonly, notip6tables) doesn't apply.Recommendation: Either fail hard on sysctl failure, or add
ip6tablesequivalents for the 14 dangerous ports.🟡 L-2 — DNS exfiltration via allowed UDP/53 (Low)
File:
containers/agent/setup-iptables.sh:244–245UDP/53 queries to configured upstream DNS servers (default: 8.8.8.8, 8.8.4.4) are unconditionally allowed. A compromised agent could encode data in DNS query names for out-of-band exfiltration.
Recommendation: Recommend
--dns-over-httpsin documentation; add UDP/53 rate-limiting (e.g.,--limit 100/min) as defense-in-depth in standard mode.🟡 L-3 — Fixed container names cause concurrent-instance conflicts (Low)
Container names (
awf-agent,awf-squid, etc.) are static. Concurrent AWF instances on the same host collide silently.Recommendation: Append the existing workdir timestamp to container names; add startup collision detection with a clear error.
i️ INFO-1 — Dev dependency CVEs (21 total, 1 high) — production unaffected
linkify-it ≤5.0.0(GHSA-22p9-wv53-3rq4): quadratic-complexity DoS inmarkdownlint-cli2(dev linting only). Production deps (commander,chalk,execa,js-yaml,ajv) are clean.Recommendation:
npm audit fixto clear noise for security scanners.🎯 Attack Surface Map
src/domain-validation.tssrc/services/agent-service.ts:146setup-iptables.sh:244containers/squid/:3128containers/api-proxy/server.js:10000-10003containers/cli-proxy/server.js:POST /exec/host/setup-iptables.sh:110/host/procentrypoint.sh:521(hidepid=2)✅ Prioritised Recommendations
bash -cwrappingsrc/services/agent-service.ts:146setup-iptables.sh:110–111setup-iptables.sh:244src/constants.tsnpm audit fixfor dev depspackage.jsondeploy.resources.limits(CPU/memory) to agent service in generated Composesrc/services/agent-service.ts📈 Security Metrics
Beta Was this translation helpful? Give feedback.
All reactions