Skip to content

fix: hide /tmp/gh-aw/mcp-config/ from agent containers#716

Closed
Mossaka wants to merge 1 commit intomainfrom
fix/mcp-pentest-followups
Closed

fix: hide /tmp/gh-aw/mcp-config/ from agent containers#716
Mossaka wants to merge 1 commit intomainfrom
fix/mcp-pentest-followups

Conversation

@Mossaka
Copy link
Collaborator

@Mossaka Mossaka commented Feb 12, 2026

Summary

Addresses CVE-003 from #197 (MCP Server Compromise Test Results).

PR #706 hid /tmp/gh-aw/mcp-logs/ from agent containers using tmpfs overlay mounts, but missed /tmp/gh-aw/mcp-config/, which may contain MCP server configuration files with tokens and credentials. A compromised MCP server or prompt injection attack could read these files to exfiltrate secrets.

This PR adds the same tmpfs hiding pattern for /tmp/gh-aw/mcp-config/ in both normal and chroot modes, making the directory appear empty inside the agent container.

Changes

  • Add tmpfs mounts for /tmp/gh-aw/mcp-config (normal mode) and /host/tmp/gh-aw/mcp-config (chroot mode) alongside the existing mcp-logs mounts

Issue #197 Pentest Findings Status

Finding Status
CVE-001: API key via /proc/1/environ Already mitigated (one-shot-token LD_PRELOAD)
CVE-002: HTTP/HTTPS exfiltration Already mitigated (Squid proxy domain filtering)
CVE-003: MCP config directory exposed Fixed in this PR
CVE-004: DNS tunneling Partially mitigated (--dns-servers restriction)

Test plan

  • npm run build passes
  • npm test passes (743 tests)
  • npm run lint passes (0 errors)
  • CI passes

🤖 Generated with Claude Code

@Mossaka @claude
fix: hide /tmp/gh-aw/mcp-config/ from agent containers
cc1161d 
PR #706 hid /tmp/gh-aw/mcp-logs/ from agent containers using tmpfs
mounts but missed /tmp/gh-aw/mcp-config/, which may contain MCP server
configuration with tokens and credentials (CVE-003 from issue #197).

Apply the same tmpfs hiding pattern for mcp-config in both normal and
chroot modes.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Copilot AI review requested due to automatic review settings February 12, 2026 05:24
@Mossaka Mossaka mentioned this pull request Feb 12, 2026
Merged
11 tasks
@github-actions
Copy link
Contributor

github-actions bot commented Feb 12, 2026 •
edited
Loading

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

@github-actions
Copy link
Contributor

github-actions bot commented Feb 12, 2026 •
edited
Loading

Chroot tests failed Smoke Chroot failed - See logs for details.

@github-actions
Copy link
Contributor

github-actions bot commented Feb 12, 2026 •
edited
Loading

💫 TO BE CONTINUED... Smoke Claude was cancelled! Our hero faces unexpected challenges...

@github-actions
Copy link
Contributor

github-actions bot commented Feb 12, 2026 •
edited
Loading

🌑 The shadows whisper... Smoke Codex failed. The oracle requires further meditation...

@github-actions
Copy link
Contributor

github-actions bot commented Feb 12, 2026 •
edited
Loading

✅ Coverage Check Passed

Overall Coverage

Metric Base PR Delta
Lines 82.25% 82.41% 📈 +0.16%
Statements 82.30% 82.46% 📈 +0.16%
Functions 82.14% 82.14% ➡️ +0.00%
Branches 74.70% 74.80% 📈 +0.10%
📁 Per-file Coverage Changes (1 files)
File Lines (Before → After) Statements (Before → After)
src/docker-manager.ts 83.5% → 84.2% (+0.67%) 82.9% → 83.6% (+0.65%)

Coverage comparison generated by scripts/ci/compare-coverage.ts

Copilot AI reviewed Feb 12, 2026
View reviewed changes
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR mitigates CVE-003 by preventing agent containers from reading MCP server configuration files under /tmp/gh-aw/mcp-config/, using the same tmpfs “empty overlay” approach already used for /tmp/gh-aw/mcp-logs/.

Changes:

  • Add tmpfs overlays for /tmp/gh-aw/mcp-config in normal mode.
  • Add tmpfs overlays for /tmp/gh-aw/mcp-config and /host/tmp/gh-aw/mcp-config in chroot mode.
  • Update inline documentation around the tmpfs hiding behavior.
Comments suppressed due to low confidence (1)

src/docker-manager.ts:736

  • This introduces new security behavior (hiding /tmp/gh-aw/mcp-config) but there are integration tests covering only the mcp-logs tmpfs hiding. Add similar tests to verify mcp-config is hidden in both normal and chroot modes, and that reading a known file path under it fails (tmpfs is empty).
    // Hide /tmp/gh-aw/mcp-logs and /tmp/gh-aw/mcp-config directories using tmpfs
    // (empty in-memory filesystems) to prevent the agent from accessing MCP server
    // logs and configuration (which may contain tokens/credentials).
    // For normal mode: hide /tmp/gh-aw/mcp-logs and /tmp/gh-aw/mcp-config
    // For chroot mode: hide both paths and their /host/ equivalents
    tmpfs: config.enableChroot
      ? [
          '/tmp/gh-aw/mcp-logs:rw,noexec,nosuid,size=1m',
          '/host/tmp/gh-aw/mcp-logs:rw,noexec,nosuid,size=1m',
          '/tmp/gh-aw/mcp-config:rw,noexec,nosuid,size=1m',
          '/host/tmp/gh-aw/mcp-config:rw,noexec,nosuid,size=1m',
        ]
      : [
          '/tmp/gh-aw/mcp-logs:rw,noexec,nosuid,size=1m',
          '/tmp/gh-aw/mcp-config:rw,noexec,nosuid,size=1m',
        ],

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

src/docker-manager.ts
Comment on lines 726 to +736
tmpfs: config.enableChroot
? [
'/tmp/gh-aw/mcp-logs:rw,noexec,nosuid,size=1m',
'/host/tmp/gh-aw/mcp-logs:rw,noexec,nosuid,size=1m',
'/tmp/gh-aw/mcp-config:rw,noexec,nosuid,size=1m',
'/host/tmp/gh-aw/mcp-config:rw,noexec,nosuid,size=1m',
]
: ['/tmp/gh-aw/mcp-logs:rw,noexec,nosuid,size=1m'],
: [
'/tmp/gh-aw/mcp-logs:rw,noexec,nosuid,size=1m',
'/tmp/gh-aw/mcp-config:rw,noexec,nosuid,size=1m',
],
Copy link

Copilot AI Feb 12, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In non-chroot mode with allowFullFilesystemAccess enabled, the host filesystem is mounted at /host, so /host/tmp/gh-aw/mcp-config (and /host/tmp/gh-aw/mcp-logs) would still be readable from inside the agent container. If these directories are meant to be hidden regardless of chroot mode, consider adding tmpfs overlays for the /host/... paths whenever /host is mounted (e.g., when allowFullFilesystemAccess is true), not only when enableChroot is true.

This issue also appears on line 721 of the same file.

Copilot uses AI. Check for mistakes.
@github-actions
Copy link
Contributor

github-actions bot commented Feb 12, 2026

Go Build Test Results ✅

All Go projects built and tested successfully.

Project Download Tests Status
color ✅ 1/1 PASS ✅
env ✅ 1/1 PASS ✅
uuid ✅ 1/1 PASS ✅

Overall: PASS ✅

AI generated by Build Test Go

@github-actions
Copy link
Contributor

github-actions bot commented Feb 12, 2026

C++ Build Test Results

Project CMake Build Status
fmt ✅ ✅ PASS
json ✅ ✅ PASS

Overall: PASS

All C++ projects built successfully.

AI generated by Build Test C++

@github-actions
Copy link
Contributor

github-actions bot commented Feb 12, 2026

Smoke Test Results

Last 2 Merged PRs:

Test Results:

  • ✅ GitHub MCP: Successfully retrieved merged PRs
  • ✅ Playwright: Page title contains "GitHub"
  • ✅ File Creation: Test file created successfully
  • ✅ Bash Tools: File verified with cat

Overall Status: PASS

cc @Mossaka @lpcox

AI generated by Smoke Copilot

@github-actions
Copy link
Contributor

github-actions bot commented Feb 12, 2026

Node.js Build Test Results

Project Install Tests Status
clsx ✅ PASS PASS
execa ✅ PASS PASS
p-limit ✅ PASS PASS

Overall: PASS ✅

All Node.js projects successfully installed dependencies and passed their test suites.

AI generated by Build Test Node.js

@github-actions
Copy link
Contributor

github-actions bot commented Feb 12, 2026

Rust Build Test Results

Project Build Tests Status
fd ✅ 1/1 PASS
zoxide ✅ 1/1 PASS

Overall: PASS ✅

All Rust projects built successfully and all tests passed.

AI generated by Build Test Rust

@github-actions
Copy link
Contributor

github-actions bot commented Feb 12, 2026

Deno Build Test Results

Project Tests Status
oak 1/1 ✅ PASS
std 1/1 ✅ PASS

Overall: ✅ PASS

All Deno tests completed successfully.

AI generated by Build Test Deno

@github-actions github-actions bot mentioned this pull request Feb 12, 2026
Closed
@github-actions
Copy link
Contributor

github-actions bot commented Feb 12, 2026

.NET Build Test Results

Project Restore Build Run Status
hello-world ✅ ✅ ✅ PASS
json-parse ✅ ✅ ✅ PASS

Overall: PASS ✅

All .NET projects successfully restored dependencies, built, and executed.

AI generated by Build Test .NET

@Mossaka Mossaka closed this Feb 12, 2026
@github-actions
Copy link
Contributor

github-actions bot commented Feb 12, 2026

Java Build Test Results ✅

All Java projects successfully compiled and tested through AWF firewall.

Project Compile Tests Status
gson ✅ 1/1 PASS
caffeine ✅ 1/1 PASS

Overall: PASS

Test Details

gson

  • Compile: SUCCESS (3.162s)
  • Tests run: 1, Failures: 0, Errors: 0, Skipped: 0

caffeine

  • Compile: SUCCESS (0.824s)
  • Tests run: 1, Failures: 0, Errors: 0, Skipped: 0

AI generated by Build Test Java

@Mossaka Mossaka reopened this Feb 12, 2026
@github-actions
Copy link
Contributor

github-actions bot commented Feb 12, 2026 •
edited
Loading

Chroot tests failed Smoke Chroot failed - See logs for details.

@github-actions
Copy link
Contributor

github-actions bot commented Feb 12, 2026 •
edited
Loading

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

@Mossaka Mossaka closed this Feb 12, 2026
@github-actions
Copy link
Contributor

github-actions bot commented Feb 12, 2026 •
edited
Loading

🌑 The shadows whisper... Smoke Codex failed. The oracle requires further meditation...

@github-actions
Copy link
Contributor

github-actions bot commented Feb 12, 2026 •
edited
Loading

💫 TO BE CONTINUED... Smoke Claude failed! Our hero faces unexpected challenges...

@github-actions
Copy link
Contributor

github-actions bot commented Feb 12, 2026

C++ Build Test Results

Project CMake Build Status
fmt ✅ ✅ PASS
json ✅ ✅ PASS

Overall: PASS ✅

All C++ projects built successfully.

AI generated by Build Test C++

@github-actions
Copy link
Contributor

github-actions bot commented Feb 12, 2026

Rust Build Test Results

Project Build Tests Status
fd ✅ 1/1 PASS
zoxide ✅ 1/1 PASS

Overall: PASS ✅

All Rust projects built and tested successfully.

AI generated by Build Test Rust

@github-actions
Copy link
Contributor

github-actions bot commented Feb 12, 2026

Bun Build Test Results

Project Install Tests Status
elysia ✅ 1/1 PASS
hono ✅ 1/1 PASS

Overall: PASS ✅

All Bun projects built and tested successfully.

AI generated by Build Test Bun

@github-actions
Copy link
Contributor

github-actions bot commented Feb 12, 2026

Smoke Test Results ✅

Last 2 Merged PRs:

Tests:

  • ✅ GitHub MCP (retrieved PR titles)
  • ✅ Playwright (verified GitHub homepage title)
  • ✅ File write (smoke-test-copilot-21934813738.txt)
  • ✅ Bash tool (verified file creation)

Status: PASS

cc @Mossaka

AI generated by Smoke Copilot

@github-actions
Copy link
Contributor

github-actions bot commented Feb 12, 2026

Go Build Test Results

Project Download Tests Status
color ✅ 1/1 PASS
env ✅ 1/1 PASS
uuid ✅ 1/1 PASS

Overall: PASS

All Go projects successfully downloaded dependencies and passed tests.

AI generated by Build Test Go

@github-actions
Copy link
Contributor

github-actions bot commented Feb 12, 2026

Deno Build Test Results

Project Tests Status
oak 1/1 ✅ PASS
std 1/1 ✅ PASS

Overall: ✅ PASS

All Deno tests completed successfully.

AI generated by Build Test Deno

@github-actions
Copy link
Contributor

github-actions bot commented Feb 12, 2026

Build Test: Node.js - Results

Project Install Tests Status
clsx ✅ PASS ✅ PASS
execa ✅ PASS ✅ PASS
p-limit ✅ PASS ✅ PASS

Overall: ✅ PASS

All Node.js projects built and tested successfully.

AI generated by Build Test Node.js

@github-actions
Copy link
Contributor

github-actions bot commented Feb 12, 2026

.NET Build Test Results

Project Restore Build Run Status
hello-world ✅ ✅ ✅ PASS
json-parse ✅ ✅ ✅ PASS

Overall: PASS ✅

All .NET projects built and ran successfully.

AI generated by Build Test .NET

@github-actions
Copy link
Contributor

github-actions bot commented Feb 12, 2026

✅ Java Build Test Results

Project Compile Tests Status
gson ✅ 1/1 PASS
caffeine ✅ 1/1 PASS

Overall: PASS

All Java projects successfully compiled and tested through the firewall with Maven proxy configuration.

AI generated by Build Test Java

@github-actions github-actions bot mentioned this pull request Feb 12, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments

Assignees

No one assigned

Labels

build-test-bun build-test-cpp build-test-deno build-test-dotnet build-test-go build-test-java build-test-node build-test-rust smoke-copilot

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@Mossaka