[Security Review] Daily Security Review 2026-10-22

[github-actions[bot]]

📊 Executive Summary

Limited-depth review. No new critical or high findings. The escape-test summary (/tmp/gh-aw/escape-test-summary.txt) was empty (0 bytes), so there is no cross-reference data from that run.

🔍 Findings from Firewall Escape Test

None available. ls -la showed the file at 0 bytes. Check that the pre-fetch step is working.

🛡️ Architecture Security Analysis

• Container (src/services/agent-service.ts:55-85):
  • NET_ADMIN is not granted to the agent. iptables setup runs in the separate awf-iptables-init container, which gets NET_ADMIN and NET_RAW with cap_drop: ALL.
  • The agent drops NET_RAW, SYS_PTRACE, SYS_MODULE, SYS_RAWIO and MKNOD.
  • no-new-privileges:true and a custom seccomp profile are applied.
  • The agent is granted SYS_CHROOT and SYS_ADMIN. Both are dropped via capsh before user code runs.
  • Memory and pids limits are set.
• Weakness (Medium): apparmor:unconfined (line 82) plus SYS_ADMIN leave a window during entrypoint.sh startup. Safety depends entirely on the capsh drop happening before user code runs. This is documented and covered by tests.
• Network:
  • setup-iptables.sh ends with a final -p tcp -j DROP and -p udp -j DROP (lines 480-482).
  • Dangerous ports are blocked, including SSH 22 (line 107).
  • DNS is restricted to configured servers.
  • Host-level iptables logic lives in host-iptables-*.ts.
• Domain validation: src/domain-patterns.ts (137 lines) and src/squid/domain-acl.ts handle normalization and ACL generation.
• Dependencies: npm audit produced no output in this environment, so nothing is confirmed.

⚠️ Threat Model (STRIDE)

Threat	Category	Likelihood	Impact	Mitigation
Agent bypasses the proxy	Tampering	Low	High	iptables DNAT, final DROP, NET_RAW dropped
Capability left over after startup	Elevation of privilege	Low	High	capsh drop, no-new-privileges, seccomp
API key exposure	Information disclosure	Low	High	api-proxy sidecar, hidepid=2 procfs
Resource exhaustion	Denial of service	Medium	Medium	mem and pids limits
Unattributed traffic	Repudiation	Low	Low	Squid and iptables logs with UID
Spoofed DNS	Spoofing	Low	Medium	DNS allowlist

🎯 Attack Surface Map

Surface	Entry point	Risk
Network egress	containers/agent/setup-iptables.sh, Squid	Low
Container privileges	src/services/agent-service.ts	Medium
Domain parsing	src/domain-patterns.ts	Low
CLI input and exec	src/cli.ts, execa callers	Low
Entrypoint	containers/agent/entrypoint.sh (1868 lines)	Medium (complexity)

📋 Evidence Collection

• wc -l: host-iptables.ts 10, setup-iptables.sh 540, domain-patterns.ts 137, entrypoint.sh 1868.
• grep cap_add|cap_drop|no-new-privileges: confirmed in agent-service.ts:66-82.
• No exploit testing was performed.

✅ Recommendations

• Critical: none.
• High: none.
• Medium:
  • Fix the escape-test summary pre-fetch, which produced an empty file.
  • Keep the integration tests that assert the capsh drop of SYS_ADMIN.
• Low:
  • Split entrypoint.sh into smaller auditable modules.
  • Run npm audit in CI and publish the result.

📈 Security Metrics

• About 2,500 lines of security-critical code inspected (the files above).
• 5 attack surfaces identified.
• All 6 STRIDE categories covered.

Generated by Daily Security Review and Threat Modeling · copilot · auto · 17.7 AIC · ⊞ 11K · ◷

• expires on Oct 29, 2026, 12:46 PM UTC