Vulnerable code sample

import os
import subprocess

def vulnerable_install_bootloader(root_fs_path, install_device):
    """
    This function represents the vulnerable logic from OpenStack ironic-python-agent.

    It mimics the behavior of executing 'grub-install' from within a chroot of
    the deployed OS image, which was the root cause of the vulnerability.
    This function requires root privileges to execute os.chroot().

    :param root_fs_path: The path to the mounted partition of the deployed image.
                         An attacker controls the contents of this filesystem.
    :param install_device: The disk device to install the bootloader onto,
                           e.g., '/dev/sda'.
    """
    command = ['grub-install', install_device]

    # The agent would chroot into the user-provided file system.
    # This is the core of the vulnerability.
    real_root_fd = os.open('/', os.O_RDONLY)

    try:
        # 1. Chroot into the untrusted directory.
        os.chroot(root_fs_path)
        os.chdir('/')

        # 2. Execute the command. The 'grub-install' binary is resolved from
        # *within* the chroot environment (e.g., from <root_fs_path>/usr/sbin/).
        # If the image contains a malicious 'grub-install', that code is executed
        # with the privileges of the agent process.
        subprocess.run(command, check=True)

    finally:
        # 3. Return to the original root directory to not affect other operations.
        os.fchdir(real_root_fd)
        os.chroot('.')
        os.close(real_root_fd)