[isolation] [PROC-ENV] Same-UID /proc environ reveals token-like env material across process boundary

[github-actions]

Summary

A container isolation boundary issue was reproduced: token-like environment material is observable across same-UID process boundaries via /proc/<pid>/environ.

No secret value was copied or disclosed. Validation used key presence and length-only checks.

Boundary Violation Type

• Process isolation / environment secrecy boundary leak
• Same-UID process A can inspect sensitive env entries of process B through /proc

Methodology (value-redacted)

Focused deep dive on environment-variable isolation:

1. Enumerated environment keys (env/printenv/export -p) without values.
2. Built runner PID census and checked /proc/<pid>/environ for key presence only.
3. Measured length-only for AWF_ONE_SHOT_TOKENS (non-zero) across multiple PIDs.
4. Ran differential control:
   • inherited sibling process -> key visible
   • env -i clean-room sibling -> key absent
5. Sampled short-lived process with synthetic marker and observed repeated external visibility via /proc during process lifetime.

Evidence (sanitized)

• AWF_ONE_SHOT_TOKENS key present in multiple runner-owned processes.
• Length-only metric was consistently non-zero (len=159) in token-bearing processes.
• Clean-room process (env -i) did not expose the key.
• Thread-level surface (/proc/<pid>/task/<tid>/environ) also showed key presence for sampled tasks.

Reproduction Steps

1. Start two sibling processes:
   • one normal inherited env
   • one with env -i PATH="$PATH" ...
2. Read /proc/<pid>/environ from another same-UID process and extract key names only.
3. Compare key presence for AWF_ONE_SHOT_TOKENS.
4. Optionally compute value length only (do not print value).

Expected

Sensitive token-like env entries should not be readable cross-process within the container, or should be protected with stronger /proc isolation semantics.

Actual

Same-UID cross-process reads can detect token-like key presence and non-zero payload length via /proc/<pid>/environ.

Version

• gh-aw version: v0.67.2 (from lock metadata/header context)
• Lock metadata also shows compiler_version: v0.67.2 and no explicit cli_version field
• Workflow run: 24149568565

Generated by Secret Digger (Codex) · ◷

• expires on Apr 9, 2026, 5:43 PM UTC