Close four bypasses Codex found on the round-42 branch:
- builtins-qualified exec sinks in an imported workdir module: the import
vetter only rejected the BARE eval/exec/compile/__import__ names, so a
workdir helper doing `import builtins; builtins.eval("...")` ran arbitrary
code at import unscanned. Recognize the execution builtins reached as an
attribute of the builtins module (or an alias), for both the direct call
and the assign-only reference (e = builtins.eval; e(...)). Requiring a
builtins root keeps a benign .compile()/.eval() on another object
(model.compile, df.eval) from being misread as a sink.
- keyword-only compile() payload: compile() accepts its source as the
source= keyword, and a standalone compile() with no positional arg
reached the payload-recovery early return (no node.args -> NO_PAYLOAD),
so its code object was executed via the fn.__code__ = c; fn() gadget
entirely unscanned. Recover the source= keyword before returning
NO_PAYLOAD (eval / exec take no keyword arguments in CPython, so an empty
node.args there is genuinely payload-less). A benign keyword-only compile
is analyzed, not blanket-blocked.
- dotted stdlib network imports in a workdir module: the vetter left the
urllib / http tops out so urllib.parse stays benign, but that also let a
helper `import urllib.request` (or http.client) open outbound connections
the static network policy never saw. Refuse the network submodules by
their full dotted name (urllib.request, urllib.robotparser, http.client,
xmlrpc.client), covering the import, `import ... as`, `from urllib.request
import ...`, and `from urllib import request` forms, while urllib.parse and
the bare tops remain importable.
- sponge child writer: sponge (moreutils) soaks up stdin and writes it to a
file argument (printf x | sponge /tmp/probe), an unguarded-child write
outside the workdir. Add it to the child-writer denylist next to tee /
patch / mktemp.
Regression coverage: TestRound43Bypasses in tests/test_sandbox_tools.py
(keyword-only compile via the __code__ / FunctionType / exec(compile())
gadgets, sponge child writer, plus a benign keyword-only compile that stays
allowed) and three workdir-module vetter cases in
tests/test_sandbox_runtime_backstop.py (builtins.eval sink denied,
urllib.request denied, urllib.parse still allowed).
997c7247f2