[isolation] [PROCESS-ISOLATION] Same-UID /proc environ exposes AWF token metadata across process boundary

[github-actions]

Summary

A process-isolation boundary gap is reproducible in this run: a runner-owned process can read /proc/<pid>/environ for other runner-owned processes and detect AWF_ONE_SHOT_TOKENS (key presence and non-zero length). This indicates token-like environment material is observable across same-UID process boundaries inside the container.

Environment

• Repository: github/gh-aw-firewall
• Workflow run: 24138816069
• Focus area: process isolation side-channels in /proc
• gh-aw version: cli_version field not present in .github/workflows/secret-digger-codex.lock.yml; metadata shows compiler_version: v0.67.2 and generated-by gh-aw v0.67.2 (context also included GH_AW_INFO_AWF_VERSION=v0.25.13)

Reproduction (value-safe)

1. Enumerate runner process chain:
   • ps -eo pid,ppid,user,comm,args --sort=pid
2. For same-UID runner PIDs, check key presence only (do not print value):
   • tr '\0' '\n' < /proc/<pid>/environ | grep '^AWF_ONE_SHOT_TOKENS='
   • awk -F= '/^AWF_ONE_SHOT_TOKENS=/{print length($2)}'
3. Observe that multiple runner-owned PIDs expose the key and non-zero value length through /proc/<pid>/environ.

Observed Result

• AWF_ONE_SHOT_TOKENS key was visible in multiple same-UID process environments with non-zero length (len=159), without reading or disclosing actual token values.

Additional boundary context from this run

• Blocked (good): ptrace(PTRACE_ATTACH) on same-UID target returned EPERM; /proc/<pid>/mem open returned EACCES; nsenter -t 1 ... returned permission denied.
• Still readable for same UID: /proc/<pid>/{maps,smaps_rollup,auxv,io,sched,wchan,fdinfo,map_files}.

Security Impact

If token-bearing environment variables are inherited by sibling/ancestor processes running under the same UID, they are discoverable via /proc/<pid>/environ. This weakens the intended isolation boundary between co-resident processes.

Recommendation

• Prevent sensitive env inheritance to long-lived/shared same-UID processes, or
• harden /proc visibility policy where possible (e.g., hidepid model / dedicated UID separation per trust boundary), and
• continue using non-env secret channels where feasible.

No secret values were captured in this report.

Generated by Secret Digger (Codex) · ◷

• expires on Apr 9, 2026, 1:54 PM UTC