Close four bypasses Codex found on the round-44 branch:
- fn.__code__ = <code object>: rebinding a function's code runs it via fn()
WITHOUT eval / exec, the __code__ twin of the FunctionType gadget. The
assignment visitor only checked container-stored exec aliases, so
co = codeop.compile_command('...'); f.__code__ = co; f() ran unanalyzed
source. Flag a __code__ store whose RHS is not a vetted code object; an
in-source function's code (g.__code__) and a compile() result (analyzed at
the compile site) stay allowed.
- workdir-module getattr obfuscation: the import vetter caught direct
os.system(...) but not getattr(os, 'system')('...') in an imported helper,
so the top-level analyzer saw only the file write / import and the vetter
passed. Refuse getattr on a sink-module receiver (os / posix / builtins /
deserializers) -- a constant sink attribute name, and a non-constant name
that cannot be proven benign.
- subprocess cwd= ignored for child writes: the argv scan reconstructed the
git command but dropped cwd=, so subprocess.run(['git','init','repo'],
cwd='/tmp') created /tmp/repo outside the workdir. Model a literal escaping
cwd= as a synthetic `env -C <cwd>` wrapper on the reconstructed command so
the existing git cwd backscan resolves the escape; a workdir-relative cwd
adds no wrapper and stays allowed.
- GNU env glued -C / -u operands: env -C/tmp git init repo (and
env -uGIT_CONFIG_COUNT git ...) glue the chdir / unset operand directly onto
the short flag, which the separated and --long= scans missed, so the git cwd
and hook-suppression backscan never saw the escape. Parse the glued short
forms alongside the separated ones.
Regression coverage: TestRound45Bypasses in tests/test_sandbox_tools.py
(__code__ store of a producer / opaque code object blocked while a compile()
result and g.__code__ stay allowed; subprocess git under an escaping cwd
blocked while a workdir-relative cwd is allowed; env -C/tmp and
-uGIT_CONFIG_COUNT before git blocked while plain env git init is allowed) and
two workdir-module vetter cases in tests/test_sandbox_runtime_backstop.py
(getattr(os,'system') helper denied, benign getattr on a plain object allowed).
8814d7de3b