fix: relax gh-aw handoff permissions after AWF exits by Copilot · Pull Request #9029 · github/gh-aw-firewall

Copilot · 2026-09-26T01:18:28Z

Host-side steps that run after the AWF agent container exits (e.g. gh-aw's validateMemoryStep for tools.cache-memory) can fail with EACCES: permission denied when writing into /tmp/gh-aw (e.g. memory-validation/cache-default.ok). AWF remaps the agent's UID/GID to match the host user, but files created during the run can still end up with ownership/mode that a later host-side identity can't write into.

`containers/agent/entrypoint.sh`

Set umask 0002 for the user command so new files/dirs the agent creates under /tmp/gh-aw default to group-writable.
Added relax_gh_aw_shared_permissions(), run as root right after the agent command exits (both the normal exit path and the signal-driven cleanup path), which chmod -R g+w's the /tmp/gh-aw tree (/host/tmp/gh-aw in chroot mode, /tmp/gh-aw otherwise) without making it world-writable.
Note: this cleanup must live in run_agent_with_token_protection() rather than after the chroot ... exec capsh invocation in run_chroot_command, since exec capsh replaces the chroot shell's process image and any code placed after it there would never run.

Tests

tests/entrypoint-phase-functions.test.sh: added a fixture test asserting relax_gh_aw_shared_permissions() adds the group-write bit without widening to world-writable, and that it's wired into run_agent_with_token_protection().

Docs

docs/environment.md: documented the UID/GID remap vs. shared /tmp/gh-aw interaction, why it can still mismatch (e.g. AWF invoked as native root without sudo), and the mitigation, with guidance to prefer sudo awf when possible.

Fixes [awf] agent entrypoint: cache-memory validation marker write fails with EACCES due to UID remap on /tmp/gh-aw #9028

…n host-side steps Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot

Copilot review overview

🟡 Changes recommended

Cleanup is skipped after failed commands, and permission widening can expose sensitive files beyond the intended handoff directory.

Review effort: Balanced
Findings: 1 · 1 · 1

Open (3)

Recursive repair exposes protected API-proxy audit files · New
Cleanup is skipped when the agent command fails · New
Test assertion does not verify permission repair call sites · New

What changed in this PR

Adds post-agent permission repair for /tmp/gh-aw to prevent host-side EACCES failures.

Changes:

Adds group-permission cleanup and a relaxed umask.
Adds shell coverage for permission repair.
Documents UID/GID behavior and mitigation.

File	Description
`containers/agent/entrypoint.sh`	Adds shared-directory permission handling.
`tests/entrypoint-phase-functions.test.sh`	Tests the new helper and wiring.
`docs/environment.md`	Documents shared-path permissions.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

lpcox · 2026-09-26T16:02:14Z

@copilot address review feedback

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot · 2026-09-26T16:13:41Z

@copilot address review feedback

Addressed the review feedback in dd6927f: narrowed permission repair to validated gh-aw handoff directories, skipped unsafe symlink/non-directory roots without recursive chmod, preserved cleanup on failed/signaled commands, and added targeted regression coverage.

github-actions · 2026-09-26T16:14:28Z

✅ Copilot review passed with no inline comments.

@copilot Add the ready-for-aw label to this PR to trigger agentic CI smoke tests.

github-actions · 2026-09-26T16:14:56Z

Documentation Preview

Documentation has been built for this PR.

Download preview artifact

To view locally:

Download the docs-preview-pr-9029 artifact from the workflow run
Unzip and open index.html in your browser

Built from commit e886d19

github-actions · 2026-09-26T17:08:31Z

❌ Smoke Gemini reports failed. Facets need polishing...

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

play.googleapis.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "play.googleapis.com"

See Network Configuration for more information.

💎 Faceted by Smoke Gemini

github-actions · 2026-09-26T17:08:34Z

✅ Smoke Claude passed

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

api.anthropic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.anthropic.com"

See Network Configuration for more information.

Generated by Smoke Claude for #9029

github-actions · 2026-09-26T17:08:36Z

✅ Security Guard completed successfully!

PR #9029 security review complete. Change: Added permission relaxation for gh-aw handoff directories in containers/agent/entrypoint.sh. The modification adds group-write permissions to specific whitelisted directories (/tmp/gh-aw/memory-validation) after agent exit. Security assessment: PASS. The implementation includes proper controls: symlink detection, directory validation, explicit allowlist (GH_AW_HOST_HANDOFF_DIRS), scope limitation to group-write only, and clear logging. This is a deliberate, scoped adjustment for post-agent inter-process coordination on multi-user runners, not a security regression.

Generated by Security Guard for #9029

github-actions · 2026-09-26T17:08:41Z

🛡️ Smoke Copilot Network Isolation confirmed the egress allowlist is enforced. ✅

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

api.github.com
example.com

[!TIP]
api.github.com is blocked because GitHub API access uses the built-in GitHub tools by default. Instead of adding api.github.com to network.allowed, use tools.github.mode: gh-proxy for direct pre-authenticated GitHub CLI access without requiring network access to api.github.com:

tools:
  github:
    mode: gh-proxy

See GitHub Tools for more information on gh-proxy mode.

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.github.com"
    - "example.com"

See Network Configuration for more information.

🛡️ Egress verdict from Smoke Copilot Network Isolation

github-actions · 2026-09-26T17:11:16Z

Smoke Test: Claude Engine Validation

Check	Status
API	✅ PASS
gh CLI	✅ PASS
File	✅ PASS

Overall result: PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

api.anthropic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.anthropic.com"

See Network Configuration for more information.

Generated by Smoke Claude for #9029 · claude · haiku45 · 55.9 AIC · ⊞ 4.7K · ◷
_{Add label ready-for-aw to run again}

github-actions · 2026-09-26T17:11:29Z

Smoke Test: Cloud Hypervisor + Copilot

list_pull_requests (github/gh-aw-firewall, merged, limit 1): PASS
curl https://github.com: PASS (200)
Write/read /tmp/gh-aw/agent/smoke-cloud-hypervisor-${GITHUB_RUN_ID}.txt: PASS
curl (example.com/redacted) (should be blocked): PASS (000)

All checks passed ✅

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

example.com
github.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "example.com"
    - "github.com"

See Network Configuration for more information.

Cloud Hypervisor + Copilot smoke test by Smoke Cloud Hypervisor
_{Add label ready-for-aw to run again}

github-actions · 2026-09-26T17:11:34Z

EGRESS_RESULT allow=pass deny=pass

✅ Allowed domain (github.com) reachable: allowed=200
✅ Non-allowed domain (example.com) blocked: OK: example.com was blocked

Overall: PASS

@lpcox

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

api.github.com
example.com

[!TIP]
api.github.com is blocked because GitHub API access uses the built-in GitHub tools by default. Instead of adding api.github.com to network.allowed, use tools.github.mode: gh-proxy for direct pre-authenticated GitHub CLI access without requiring network access to api.github.com:

tools:
  github:
    mode: gh-proxy

See GitHub Tools for more information on gh-proxy mode.

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.github.com"
    - "example.com"

See Network Configuration for more information.

🛡️ Egress verdict from Smoke Copilot Network Isolation
_{Add label ready-for-aw to run again}

github-actions · 2026-09-26T17:11:46Z

Smoke Test: Copilot Engine — @lpcox

MCP (PR fetch): ✅ PR Fix npm audit egress and alert filtering in Dependency Security Monitor #9044 Fix npm audit egress and alert filtering; PR perf: pre-fetch provider docs and validate JSON deterministically in model-api-mapping-updater #9045 perf: pre-fetch provider docs and validate JSON deterministically
GitHub.com connectivity: ✅ (HTTP 200)
File write/read: ✅

Overall: PASS

📰 BREAKING: Report filed by Smoke Copilot
_{Add label ready-for-aw to run again}

github-actions · 2026-09-26T17:11:53Z

Smoke Test: GitHub Actions Services Connectivity

Redis PING: ✅ (PONG)
PostgreSQL pg_isready: ✅ (accepting connections)
PostgreSQL SELECT 1: ✅ (1)

Overall: PASS

🔌 Service connectivity validated by Smoke Services
_{Add label ready-for-aw to run again}

github-actions · 2026-09-26T17:11:56Z

Smoke Test Results: Copilot BYOK (Direct)

✅ GitHub MCP: PR connectivity verified
✅ HTTP GET github.com: HTTP 200
✅ File I/O: Write/read test passed
✅ BYOK Inference: Agent → api-proxy sidecar → api.githubcopilot.com

Status: PASS — Running in direct BYOK mode via COPILOT_PROVIDER_API_KEY

🔑 BYOK report filed by Smoke Copilot BYOK
_{Add label ready-for-aw to run again}

github-actions · 2026-09-26T17:12:53Z

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A (run OK)	✅ PASS
.NET	json-parse	✅	N/A (run OK)	✅ PASS
Go	color	✅	ok	✅ PASS
Go	env	✅	ok	✅ PASS
Go	uuid	✅	ok	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	all passed	✅ PASS
Node.js	execa	✅	all passed	✅ PASS
Node.js	p-limit	✅	all passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 8/8 ecosystems passed — PASS

Note: Java (Maven) initially failed with Could not create local repository at /home/runner/.m2/repository -> Permission denied — a local filesystem permission issue on the runner (the default ~/.m2 dir is owned by root), unrelated to the AWF firewall/proxy. Retried successfully using -Dmaven.repo.local=/tmp/gh-aw/agent/m2-repo as an alternate writable local repo path; Maven proxy config (squid-proxy:3128) worked correctly for dependency resolution once the repo path was writable.

All 18 test projects across 8 language ecosystems built/installed and passed their test suites successfully.

Warning

Firewall blocked 8 domains

The following domains were blocked by the firewall during workflow execution:

api.nuget.org
bun.sh
dc.services.visualstudio.com
deno.land
dl.deno.land
github.com
releaseassets.githubusercontent.com
repo.maven.apache.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.nuget.org"
    - "bun.sh"
    - "dc.services.visualstudio.com"
    - "deno.land"
    - "dl.deno.land"
    - "github.com"
    - "releaseassets.githubusercontent.com"
    - "repo.maven.apache.org"

See Network Configuration for more information.

Generated by Build Test Suite for #9029 · copilot · auto · 44.1 AIC · ⊞ 11.8K · ◷
_{Add label ready-for-aw to run again}

github-actions · 2026-09-26T17:13:15Z

Chroot Version Comparison Results

Runtime	Host Version	Chroot Version	Match?
Python	Python 3.12.14	Python 3.12.14	✅ YES
Node.js	v24.21.0	v22.23.2	❌ NO
Go	go1.22.12	go1.22.12	✅ YES

Overall: FAILED — Node.js version mismatch between host and chroot environments. Python and Go versions match correctly, but the chroot Node.js version (v22.23.2) differs from the host (v24.21.0).

Since not all tests passed, the smoke-chroot label was not added.

Tested by Smoke Chroot
_{Add label ready-for-aw to run again}

github-actions · 2026-09-26T17:13:58Z

📡 Smoke Test: API Proxy OTEL Tracing — Results

#	Scenario	Result
1	Module Loading (`otel.js`)	✅ Loaded successfully; `isEnabled()` → `true`; exports 15 functions/classes including `startRequestSpan`, `setTokenAttributes`, `setBudgetAttributes`, `endSpan`, `endSpanError`, `shutdown`
2	Test Suite (`otel*.test.js`)	✅ 3 suites / 68 tests passed, 0 failed (module init, span attrs, token/budget attrs, OTLP export, fan-out, workload identity)
3	Env Var Forwarding	✅ `env-passthrough.ts` forwards `GITHUB_AW_OTEL_TRACE_ID` / `GITHUB_AW_OTEL_PARENT_SPAN_ID` to the agent; `api-proxy-env-config.ts` forwards `GH_AW_OTLP_ENDPOINTS`, `OTEL_EXPORTER_OTLP_ENDPOINT`, and the same trace context vars to the api-proxy sidecar
4	Token Tracker Integration	✅ `token-tracker-http.js` implements the `onUsage` callback (4 references) as the OTEL hook point
5	OTEL Diagnostics	⚪ No `otel.jsonl` span file found under `api-proxy-logs/` for this run — expected graceful degradation since no OTLP endpoint was configured for the api-proxy sidecar in this smoke-test environment; `token-usage.jsonl` confirms 12 proxied requests were tracked normally with no errors

Overall: All scenarios pass or are expected-pending. No regression detected in the OTEL tracing integration.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

o205451.ingest.us.sentry.io

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "o205451.ingest.us.sentry.io"

See Network Configuration for more information.

📡 OTel tracing validated by Smoke OTel Tracing
_{Add label ready-for-aw to run again}

* Initial plan * docs: add B35 and D16 failure modes Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com> * docs: update runner doctor playbook for B35 D16 * docs: refresh B35 status when PR closes * docs: mark B35 provisional pending PR merge * docs: clarify B35 fix is not yet shipped * docs: isolate B35 unmerged remediation details * docs: clarify B35 status is a dated snapshot * docs: track B35 follow-up in issue 9028 * docs: remove B35 status snapshot date * docs: link B35 pending status to canonical entry * docs: mark B35 proposal unverified * docs: mark B35 fixed by merged #9029 * docs: add B35 patched-build verification probe --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Initial plan

5af6b45

Copilot AI assigned Copilot and lpcox Sep 26, 2026

Copilot started work on behalf of lpcox September 26, 2026 01:19 View session

Copilot AI linked an issue Sep 26, 2026 that may be closed by this pull request

[awf] agent entrypoint: cache-memory validation marker write fails with EACCES due to UID remap on /tmp/gh-aw #9028

Closed

fix: relax /tmp/gh-aw permissions after agent exits to avoid EACCES i…

6e4e8ca

…n host-side steps Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Fix EACCES error for cache-memory validation marker write~~ Fix EACCES in host-side gh-aw steps writing to /tmp/gh-aw after AWF exits Sep 26, 2026

Copilot finished work on behalf of lpcox September 26, 2026 01:27

Copilot AI requested a review from lpcox September 26, 2026 01:27

github-advanced-security AI found potential problems Sep 26, 2026

View reviewed changes

Comment thread containers/agent/entrypoint.sh Outdated

lpcox marked this pull request as ready for review September 26, 2026 03:01

Copilot AI balanced review requested due to automatic review settings September 26, 2026 03:01

Copilot started reviewing on behalf of lpcox September 26, 2026 03:01 View session

Copilot AI reviewed Sep 26, 2026

View reviewed changes

Comment thread containers/agent/entrypoint.sh Outdated

Comment thread containers/agent/entrypoint.sh Outdated

Comment thread tests/entrypoint-phase-functions.test.sh Outdated

Copilot started work on behalf of lpcox September 26, 2026 16:02 View session

Copilot AI and others added 9 commits September 26, 2026 16:05

fix: harden gh-aw handoff permission repair

23bd029

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

fix: refine gh-aw permission repair cleanup

788adac

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

test: harden gh-aw handoff regression checks

92d300c

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

test: fix entrypoint fixture status capture

7766961

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

test: execute gh-aw cleanup regression paths

fd16302

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

fix: refine gh-aw handoff cleanup validation

0ce4769

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

fix: stop unsafe gh-aw handoff fallback

3522a81

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

test: consolidate entrypoint fixture generation

a9c6211

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

fix: unify gh-aw handoff root validation

dd6927f

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot finished work on behalf of lpcox September 26, 2026 16:14

github-advanced-security AI found potential problems Sep 26, 2026

View reviewed changes

Comment thread containers/agent/entrypoint.sh Outdated

lpcox had a problem deploying to aoai-model September 26, 2026 17:08 — with GitHub Actions Failure

Copilot AI mentioned this pull request Sep 26, 2026

Document B35 and D16 runner failure modes #9053

Merged

github-actions Bot added the smoke-claude label Sep 26, 2026

github-actions Bot added the smoke-cloud-hypervisor label Sep 26, 2026

github-actions Bot added the smoke-copilot-network-isolation Copilot network-isolation egress smoke test label Sep 26, 2026

lpcox deployed to aoai-model September 26, 2026 17:11 — with GitHub Actions Active

github-actions Bot added smoke-copilot smoke-services labels Sep 26, 2026

github-actions Bot added the smoke-copilot-byok label Sep 26, 2026

lpcox deployed to aoai-model September 26, 2026 17:11 — with GitHub Actions Active

github-actions Bot added the build-test label Sep 26, 2026

lpcox merged commit 2c1e42b into main Sep 26, 2026
161 of 165 checks passed

lpcox deleted the copilot/awf-fix-cache-memory-validation branch September 26, 2026 17:21

Copilot AI added a commit that referenced this pull request Sep 26, 2026

docs: mark B35 fixed by merged #9029

ceec789

github-actions Bot mentioned this pull request Sep 27, 2026

🩺 Runner Doctor UpdatePortable doctor agent missing B35/D16 catalog rows added to shared docs #9081

Closed

Copilot AI mentioned this pull request Sep 27, 2026

Sync portable runner doctor with B35 and D16 catalog entries #9092

Closed

Conversation

Copilot AI commented Sep 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

containers/agent/entrypoint.sh

Tests

Docs

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Uh oh!

lpcox commented Sep 26, 2026

Uh oh!

Copilot AI commented Sep 26, 2026

Uh oh!

github-actions Bot commented Sep 26, 2026

Uh oh!

github-actions Bot commented Sep 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Documentation Preview

Uh oh!

Uh oh!

github-actions Bot commented Sep 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 26, 2026

Smoke Test: Claude Engine Validation

Uh oh!

github-actions Bot commented Sep 26, 2026

Smoke Test: Cloud Hypervisor + Copilot

Uh oh!

github-actions Bot commented Sep 26, 2026

Uh oh!

github-actions Bot commented Sep 26, 2026

Uh oh!

github-actions Bot commented Sep 26, 2026

Uh oh!

github-actions Bot commented Sep 26, 2026

Smoke Test Results: Copilot BYOK (Direct)

Uh oh!

github-actions Bot commented Sep 26, 2026

🏗️ Build Test Suite Results

Uh oh!

github-actions Bot commented Sep 26, 2026

Chroot Version Comparison Results

Uh oh!

github-actions Bot commented Sep 26, 2026

📡 Smoke Test: API Proxy OTEL Tracing — Results

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Copilot AI commented Sep 26, 2026 •

edited

Loading

`containers/agent/entrypoint.sh`

github-actions Bot commented Sep 26, 2026 •

edited

Loading

github-actions Bot commented Sep 26, 2026 •

edited

Loading

github-actions Bot commented Sep 26, 2026 •

edited

Loading

github-actions Bot commented Sep 26, 2026 •

edited

Loading

github-actions Bot commented Sep 26, 2026 •

edited

Loading