Summary
PR #607 adds runtime configuration for the one-shot token library (AWF_ONE_SHOT_TOKENS), which addresses secret leaking via getenv() (path 1 of the attack surface identified in githubnext/gh-aw-security#62).
However, two additional exposure paths remain unmitigated:
1. /proc/self/environ bypasses LD_PRELOAD
The kernel exposes all environment variables of a process through /proc/self/environ. Reading this file directly bypasses getenv() entirely, so the LD_PRELOAD one-shot token library cannot intercept it.
cat /proc/self/environ | tr '\0' '\n' | grep COPILOT_GITHUB_TOKEN
2. Docker Compose file contains plaintext tokens
AWF writes sensitive tokens (e.g., COPILOT_GITHUB_TOKEN) in plaintext into the generated docker-compose.yml at /tmp/awf-*/docker-compose.yml. Since the host filesystem is mounted into the container at /host, the agent can read:
cat /host/tmp/awf-*/docker-compose.yml | grep -A 2 COPILOT_GITHUB_TOKEN
Proposed Mitigations
-
/proc/self/environ: Mount procfs with restricted access, or overwrite sensitive env vars in the process environment before executing the agent command (after the legitimate consumer has read them).
-
Docker Compose file: Either:
- Remove/redact sensitive values from the compose file after containers start
- Use Docker secrets instead of environment variables
- Restrict the
/host mount to exclude /tmp/awf-*
- Make the workdir path inaccessible from within the container
Related
Summary
PR #607 adds runtime configuration for the one-shot token library (
AWF_ONE_SHOT_TOKENS), which addresses secret leaking viagetenv()(path 1 of the attack surface identified in githubnext/gh-aw-security#62).However, two additional exposure paths remain unmitigated:
1.
/proc/self/environbypassesLD_PRELOADThe kernel exposes all environment variables of a process through
/proc/self/environ. Reading this file directly bypassesgetenv()entirely, so theLD_PRELOADone-shot token library cannot intercept it.2. Docker Compose file contains plaintext tokens
AWF writes sensitive tokens (e.g.,
COPILOT_GITHUB_TOKEN) in plaintext into the generateddocker-compose.ymlat/tmp/awf-*/docker-compose.yml. Since the host filesystem is mounted into the container at/host, the agent can read:Proposed Mitigations
/proc/self/environ: Mount procfs with restricted access, or overwrite sensitive env vars in the process environment before executing the agent command (after the legitimate consumer has read them).Docker Compose file: Either:
/hostmount to exclude/tmp/awf-*Related
AWF_ONE_SHOT_TOKENSCOPILOT_GITHUB_TOKENexposed in Docker Compose environment configuration