Patched code sample

import os
import subprocess
import pwd
import sys
import tempfile

def secure_execute_op_script(script_path, username):
    """
    Securely executes a user-provided op script by dropping privileges
    to that of the requesting user before execution. This function
    simulates a system component that must run as root but needs to
    execute user scripts safely.

    Args:
        script_path (str): The absolute path to the Python script to execute.
        username (str): The low-privileged user on whose behalf to run the script.
    """
    
    # This function is designed to be called by a process running with root privileges.
    # The core of the security fix is to drop these privileges before executing
    # the user-provided script.
    if os.geteuid() != 0:
        raise PermissionError("This function requires root privileges to drop to another user.")

    # 1. Retrieve the UID and GID of the target non-privileged user.
    try:
        pwnam = pwd.getpwnam(username)
        target_uid = pwnam.pw_uid
        target_gid = pwnam.pw_gid
    except KeyError:
        sys.stderr.write(f"Error: User '{username}' not found. Cannot execute script.\n")
        return

    # 2. Define a pre-execution function to be run in the child process.
    #    This function will change the process's user and group IDs.
    def drop_privileges():
        try:
            # Set the group ID first, then the user ID.
            os.setgid(target_gid)
            os.setuid(target_uid)
        except OSError as e:
            # If this fails, the child process must exit to prevent execution.
            sys.stderr.write(f"Fatal: Child process failed to drop privileges: {e}\n")
            sys.exit(127)

    # 3. Execute the script using subprocess.run with the `preexec_fn` argument.
    #    `preexec_fn` is the key mechanism for the fix. It ensures that `drop_privileges`
    #    is called in the child process just before the script is executed.
    #    This mitigates the privilege escalation vulnerability.
    try:
        print(f"Runner (UID: {os.geteuid()}) executing script for user '{username}' (UID: {target_uid}).")
        result = subprocess.run(
            ['/usr/bin/env', 'python3', script_path],
            check=False,  # We will check the return code manually
            capture_output=True,
            text=True,
            preexec_fn=drop_privileges
        )
        
        print("\n--- Script Execution Result ---")
        print(f"Script exit code: {result.returncode}")
        print("\n--- Script STDOUT ---")
        print(result.stdout or "[No standard output]")
        if result.stderr:
            print("\n--- Script STDERR ---")
            print(result.stderr)
        print("---------------------------\n")

    except FileNotFoundError:
        sys.stderr.write(f"Error: Could not find '/usr/bin/env' or 'python3'.\n")
    except Exception as e:
        sys.stderr.write(f"An unexpected error occurred during subprocess execution: {e}\n")


# --- Demonstration ---
# The following code sets up and runs a demonstration of the secure function.
# It should be executed with root privileges (e.g., `sudo python your_script.py`).
if __name__ == '__main__':
    if os.geteuid() != 0:
        print("Please run this script with sudo to demonstrate privilege dropping.", file=sys.stderr)
        sys.exit(1)

    # 1. Define a low-privileged user for the simulation (e.g., 'nobody').
    #    This user typically exists on Unix-like systems and has minimal permissions.
    LOW_PRIV_USER = "nobody"
    try:
        pwd.getpwnam(LOW_PRIV_USER)
    except KeyError:
        print(f"Test user '{LOW_PRIV_USER}' not found. Cannot run demonstration.", file=sys.stderr)
        sys.exit(1)

    # 2. Create a temporary "malicious" script.
    #    This script attempts to perform a privileged action (read /etc/shadow).
    #    In a vulnerable system, this would succeed. In the fixed system, it will fail.
    script_content = """
import os
import pwd
try:
    current_uid = os.geteuid()
    username = pwd.getpwuid(current_uid).pw_name
    print(f"Script now running as user: '{username}' (UID: {current_uid})")

    print("Attempting to read '/etc/shadow'...")
    with open('/etc/shadow', 'r') as f:
        print("VULNERABILITY CONFIRMED: Successfully read privileged file!")
        print(f.read(100) + "...")
except PermissionError:
    print("SUCCESSFULLY FIXED: Permission denied when reading '/etc/shadow'.")
except Exception as e:
    print(f"An unexpected error occurred in script: {e}")
"""
    
    # 3. Write the script to a temporary file.
    temp_dir = tempfile.mkdtemp()
    script_file_path = os.path.join(temp_dir, "privesc_attempt.py")
    try:
        with open(script_file_path, "w") as f:
            f.write(script_content)

        # Make directory and file readable/executable by the low-privileged user
        os.chmod(temp_dir, 0o755)
        os.chmod(script_file_path, 0o755)

        # 4. Run the demonstration.
        print("--- Starting CVE-2026-33793 Fix Demonstration ---")
        secure_execute_op_script(script_file_path, LOW_PRIV_USER)
        print("--- Demonstration Complete ---")
        print("Observe the output above: the script should have run as the low-privileged")
        print("user and failed to read the privileged file due to 'Permission denied'.")

    finally:
        # 5. Clean up temporary files.
        if os.path.exists(script_file_path):
            os.remove(script_file_path)
        if os.path.exists(temp_dir):
            os.rmdir(temp_dir)