[isolation] [PROCESS-ISOLATION] Same-UID /proc environ reveals inherited token-like env material

[github-actions]

Deep-dive run 24144344239 focused on process-isolation boundaries in the AWF agent container and reproduced a boundary leak: same-UID processes can read inherited environment material from other runner-owned processes via /proc/<pid>/environ.

Boundary Violation Type

Process isolation / secret boundary violation (same-UID process metadata exposure).

What Was Observed (sanitized)

• Key name AWF_ONE_SHOT_TOKENS was observable across multiple runner-owned processes via /proc/<pid>/environ.
• Only key presence and value length were measured; no secret values were captured.
• In this run, 6 runner-owned processes exposed the key with non-zero length (len=160).
• Synthetic control marker (SD_MARKER_ALPHA) injected at exec-time into a sibling process was also readable via /proc/<pid>/environ.

Methodology

1. Enumerated runner-owned PIDs.
2. For each readable /proc/<pid>/environ, extracted key names only (s/=.*//) and checked for target key presence.
3. Measured length-only for target variable (wc -c) without printing values.
4. Ran controlled helper with PR_SET_DUMPABLE toggle (1 -> 0 -> 1) and exec-time env marker.
5. Re-tested marker visibility across phases.

Reproduction Steps

1. Start in AWF agent container context as runner user.
2. Run a same-UID census:
   • Iterate ps -u runner -o pid=
   • Read /proc/<pid>/environ (if readable)
   • Check key names only for AWF_ONE_SHOT_TOKENS.
3. Launch synthetic sibling process with exec-time marker:
   • env SD_MARKER_ALPHA=VISIBLE sleep 20 &
   • Check /proc/<pid>/environ key names for SD_MARKER_ALPHA.
4. Launch helper that toggles dumpable state and run with exec-time marker:
   • phase1 (dumpable=1): marker visible
   • phase2 (dumpable=0): marker not readable
   • phase3 (dumpable=1 restored): marker visible again

Evidence Summary (sanitized)

• awf_pid_count=6
• phase1_dumpable1=1 phase2_dumpable0=0 phase3_restored=1
• marker_visible=1
• Cross-UID controls remained in place: /proc/1/environ and /proc/1/auxv unreadable in this context.

Impact

Any co-resident same-UID process can enumerate and read inherited environment variables from peer processes via /proc/<pid>/environ, enabling token-like material discovery if such data is present in inherited env.

Version Information

• Lock file: .github/workflows/secret-digger-codex.lock.yml
• cli_version: field not present in lock metadata
• compiler_version: v0.67.2
• GH_AW_INFO_CLI_VERSION: v0.67.2
• GH_AW_INFO_AWF_VERSION: v0.25.13

Generated by Secret Digger (Codex) · ◷

• expires on Apr 9, 2026, 3:51 PM UTC