Patched code sample

import os
import pwd
import grp
from pathlib import Path

def apply_datadog_permission_fix():
    """
    This function demonstrates the fix for CVE-2025-61667.

    The vulnerability was caused by insufficient permissions on the directory
    `/opt/datadog-agent/python-scripts/__pycache__`, which could allow a
    local low-privilege user to write malicious compiled Python files (.pyc)
    to it. These files would then be executed with higher privileges during an
    agent upgrade.

    The fix involves two key steps, which would be run as part of the agent's
    installation or upgrade script (e.g., a post-install script in a .deb
    or .rpm package):

    1.  Set the ownership of the directory to a privileged user (e.g., 'root').
    2.  Set the directory permissions to be non-writable by anyone other than
        the owner.

    This script must be run with root privileges to succeed, which is the
    context in which agent installations and upgrades occur.
    """
    vulnerable_dir = Path("/opt/datadog-agent/python-scripts/__pycache__")
    
    # Define the secure owner and group. Installation files should be owned by root.
    secure_owner_name = "root"
    secure_group_name = "root"
    
    # Define secure permissions: 0o755 means rwxr-xr-x.
    # - Owner (root): Can read, write, and execute (list directory contents).
    # - Group (root): Can read and execute.
    # - Others: Can read and execute.
    # This configuration prevents any non-root user from modifying the directory.
    secure_permissions = 0o755

    try:
        # Ensure the directory exists before attempting to modify it.
        # In a real scenario, the package installer would have created it.
        if not vulnerable_dir.is_dir():
            # If the directory doesn't exist, there is nothing to fix.
            return

        # Get the numeric user ID (uid) and group ID (gid) from their names.
        owner_uid = pwd.getpwnam(secure_owner_name).pw_uid
        group_gid = grp.getgrnam(secure_group_name).gr_gid

        # --- THE FIX ---
        
        # 1. Set the correct ownership on the directory.
        # This prevents other users from having unintended control via ownership.
        current_stat = vulnerable_dir.stat()
        if current_stat.st_uid != owner_uid or current_stat.st_gid != group_gid:
            os.chown(vulnerable_dir, owner_uid, group_gid)

        # 2. Set the correct, restrictive file permissions.
        # This is the primary fix that removes the vulnerability by revoking
        # write access for unprivileged users.
        if (current_stat.st_mode & 0o777) != secure_permissions:
            os.chmod(vulnerable_dir, secure_permissions)

    except FileNotFoundError:
        # This case is handled by the `is_dir()` check, but is good practice.
        pass
    except (KeyError, PermissionError):
        # KeyError: If the user 'root' or group 'root' does not exist.
        # PermissionError: If the script is not run with sufficient privileges.
        # In a real installer script, this would cause the installation to fail.
        # For this demonstration, we simply pass.
        pass

# In a real scenario, this function would be invoked by the package manager
# after the agent's files are installed on the system.
#
# if __name__ == '__main__':
#     # This would be run as root during agent installation/upgrade.
#     apply_datadog_permission_fix()