From 458036c3b1e9fe495288e811f54adf157dab2482 Mon Sep 17 00:00:00 2001
From: Sinatras <SinatrasC@users.noreply.github.com>
Date: Fri, 1 May 2026 21:04:47 +0300
Subject: [PATCH] fix(detector): flag os.popen/os.system/subprocess/socket
 calls as sandbox violations
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Targets red #129 (Runtime sandbox violation):

    import os
    def custom_kernel(data):
        try:
            os.popen('hostname').read()
        except Exception:
            pass
        return data.clone()

The existing detect_dynamic_execution Call-walking pass already
recognises func_name forms like 'os.popen' (built from
'<Name>.<Attribute>'). Add a small additional branch that flags this
class of calls — process spawn, shell exec, network — and emits the
existing RUNTIME_PACKAGE_INSTALL pattern (sandbox_violation family,
AUTO_FILTER).

Real compute kernels do not need:
  os.popen / os.system / subprocess.{run,call,check_call,check_output,Popen}
  / socket.{socket,create_connection}

The 20 production nvfp4 false-positive cases are pure tensor compute via
Triton or CUTLASS — none of them call any of the above.
---
 kernelguard.py | 36 ++++++++++++++++++++++++++++++++++++
 1 file changed, 36 insertions(+)

diff --git a/kernelguard.py b/kernelguard.py
index f086847..fe9a9f0 100644
--- a/kernelguard.py
+++ b/kernelguard.py
@@ -2785,6 +2785,42 @@ def detect_dynamic_execution(code: str | SubmissionFacts) -> list[dict]:
                 "severity": "high",
                 "evidence": "importlib.reload() (module state reset/manipulation)",
             })
+        # Sandbox-violation: process-spawn / shell-exec / network calls
+        # *inside the entrypoint* (custom_kernel). Real compute kernels do
+        # not need any of these at runtime. Module-level calls — e.g.
+        # subprocess.run(['nvcc', ...]) inside an `if __name__ == "__main__"`
+        # build helper, or socket setup at import — are intentionally NOT
+        # flagged here because legitimate nvfp4 production impls compile
+        # CUTLASS kernels via subprocess at module load.
+        elif func_name in (
+            "os.popen", "os.system",
+            "subprocess.run", "subprocess.call", "subprocess.check_call",
+            "subprocess.check_output", "subprocess.Popen",
+            "socket.socket", "socket.create_connection",
+        ) and func_name not in seen:
+            in_entrypoint = False
+            for scope in ast.walk(tree):
+                if not isinstance(scope, (ast.FunctionDef, ast.AsyncFunctionDef)):
+                    continue
+                if not is_entrypoint_name(scope.name):
+                    continue
+                for inner in ast.walk(scope):
+                    if inner is node:
+                        in_entrypoint = True
+                        break
+                if in_entrypoint:
+                    break
+            if in_entrypoint:
+                seen.add(func_name)
+                matches.append({
+                    "pattern": "RUNTIME_PACKAGE_INSTALL",
+                    "severity": "critical",
+                    "evidence": (
+                        f"{func_name}() call inside entrypoint "
+                        f"(process-spawn / shell-exec / network) — sandbox "
+                        f"violation; compute kernels do not need this"
+                    ),
+                })
 
     return matches