Patched code sample

import ctypes
import os
import sys

# This is a conceptual fix demonstrating how one might mitigate a vulnerability
# like the fictional CVE-2026-39421. The actual fix in the C-based sandbox.so
# would involve intercepting the pkey_mprotect syscall.
#
# This Python-level equivalent demonstrates a more robust sandboxing approach
# using seccomp, which can be configured from Python before executing untrusted
# code. Seccomp operates at the kernel level, making it immune to bypasses
_is_linux = sys.platform.startswith("linux")
if _is_linux:
    try:
        import prctl
        from seccomp import (
            SyscallFilter,
            ERRNO,
            ALLOW,
            KILL_PROCESS,
        )
    except ImportError:
        # Note: This conceptual fix requires python-prctl and seccomp libraries.
        # You can install them with: pip install python-prctl seccomp
        _is_linux = False


class FixedToolExecutor:
    """
    A conceptual ToolExecutor that fixes the sandbox escape vulnerability
    by applying a strict seccomp filter before executing tool code.

    This filter operates on a whitelist basis, denying all system calls
    by default and only allowing a known-safe subset required for basic
    Python operations.

    Crucially, this blocks the `pkey_mprotect` syscall (and others like `socket`,
    `connect`, `execve`), preventing the described exploit chain at the kernel
    level, regardless of what the LD_PRELOAD sandbox does or does not intercept.
    """

    # A whitelist of system calls generally considered safe for sandboxed execution.
    # This list is for demonstration and would need to be carefully curated for
    # a real production environment.
    ALLOWED_SYSCALLS = [
        "read", "write", "openat", "close", "fstat", "lseek", "brk", "mmap",
        "munmap", "mprotect", "rt_sigaction", "rt_sigprocmask", "select",
        "getpid", "gettid", "uname", "exit_group", "readv", "writev",
        # And other necessary, non-dangerous syscalls...
    ]

    def _apply_seccomp_sandbox(self):
        """
        Configures and applies the seccomp filter.
        """
        if not _is_linux:
            print("Warning: Seccomp is only available on Linux. "
                  "Sandbox cannot be fully applied.", file=sys.stderr)
            return

        # By default, kill the process for any syscall not in the whitelist.
        # This is the core of the fix: deny-by-default.
        f = SyscallFilter(defaction=KILL_PROCESS)

        # Allow the safe-listed syscalls.
        for syscall_name in self.ALLOWED_SYSCALLS:
            f.add_rule(ALLOW, syscall_name)

        # The vulnerability description notes that the original sandbox correctly
        # blocks mprotect with PROT_EXEC. We can enforce this at the seccomp level
        # for even greater security. The third argument is `prot`.
        # PROT_EXEC = 0x4
        f.add_rule(ALLOW, "mprotect",
                   ("arg2", "&", 0x4), "!=", 0x4) # If PROT_EXEC is set, deny.
        f.add_rule(ERRNO(1), "mprotect", # Otherwise, allow but return EPERM.
                   ("arg2", "&", 0x4), "==", 0x4)

        # The `pkey_mprotect` syscall, which was the bypass vector, is NOT in the
        # ALLOWED_SYSCALLS list. Therefore, the default action `KILL_PROCESS`
        # will apply to it, effectively fixing the vulnerability.

        # Load the filter into the kernel.
        f.load()
        # Restrict the process from changing its privileges.
        prctl.set_no_new_privs(1)

    def execute_tool_code(self, untrusted_code: str):
        """
        Executes untrusted code after applying the seccomp sandbox.

        Args:
            untrusted_code: A string containing the Python code from a tool.
        """
        print("--- [FixedToolExecutor] Applying seccomp sandbox ---")
        try:
            self._apply_seccomp_sandbox()
            print("--- [FixedToolExecutor] Sandbox applied. Executing tool code... ---")
            # In a real scenario, this would likely run in a separate,
            # unprivileged process. For this example, we apply it to the
            # current process before `exec`.
            exec(untrusted_code, {"__builtins__": __builtins__})
        except Exception as e:
            # Note: A seccomp violation (like calling pkey_mprotect) will
            # result in the OS killing the process with a SIGSYS signal.
            # This exception block would likely not be hit in that case.
            # This is here to catch other potential Python errors.
            print(f"--- [FixedToolExecutor] Caught a Python-level error: {e} ---")
        print("--- [FixedToolExecutor] Tool code execution finished (or was terminated). ---")


if __name__ == '__main__':
    # This is the malicious code an attacker would try to run.
    # It attempts to use ctypes to call the `pkey_mprotect` syscall directly,
    # bypassing the LD_PRELOAD hook to make a memory region executable.
    # Syscall number for pkey_mprotect on x86_64 is 329.
    # PROT_READ = 0x1, PROT_WRITE = 0x2, PROT_EXEC = 0x4
    malicious_payload = """
import ctypes
import mmap

print("[Payload] Attempting to bypass sandbox via pkey_mprotect...")

try:
    libc = ctypes.CDLL(None)
    syscall = libc.syscall

    # Syscall number for pkey_mprotect on x86_64
    PKEY_MPROTECT_SYSCALL_NR = 329
    
    # Constants for memory protection
    PROT_READ = 0x1
    PROT_WRITE = 0x2
    PROT_EXEC = 0x4

    # Allocate a memory page
    buf = mmap.mmap(-1, mmap.PAGESIZE, prot=PROT_READ | PROT_WRITE)
    addr = ctypes.addressof(ctypes.c_void_p.from_buffer(buf))
    print(f"[Payload] Allocated memory buffer at address: {hex(addr)}")
    
    # Attempt to call pkey_mprotect to make the buffer executable
    print("[Payload] Calling syscall -> pkey_mprotect to add PROT_EXEC...")
    # This call will be blocked by the seccomp filter, and the OS will
    # terminate the process. The "SUCCESS" message will not be printed.
    ret = syscall(PKEY_MPROTECT_SYSCALL_NR, addr, mmap.PAGESIZE, PROT_READ | PROT_EXEC, -1)
    
    if ret == 0:
        print("[Payload] SUCCESS: pkey_mprotect call succeeded! Sandbox bypassed.")
        # At this point, an attacker would write shellcode to the buffer
        # and execute it.
    else:
        # This part is unlikely to be reached if seccomp is active.
        print(f"[Payload] FAILURE: pkey_mprotect call failed with code {ret}.")

except Exception as e:
    print(f"[Payload] An exception occurred: {e}")
"""

    executor = FixedToolExecutor()
    print("Attempting to run malicious payload with the FixedToolExecutor.")
    print("Expected outcome: The program is terminated by the OS due to a "
          "seccomp violation (Bad system call).\n")

    # When this function is called on a compatible Linux system,
    # the process will be terminated by the kernel as soon as the
    # `syscall(PKEY_MPROTECT_SYSCALL_NR, ...)` line is executed.
    executor.execute_tool_code(malicious_payload)