Studio: harden auto permission network gates

studio/backend/core/inference/sandbox_site/sitecustomize.py

@@ -28,6 +28,8 @@
 """
 
 import builtins
+import importlib
+import importlib.util
 import io
 import json
 import os
@@ -46,6 +48,140 @@
 # on-disk sidecar carries the map across runs. It records only sources the
 # fallback healed, so an unrelated same-basename file is never adopted.
 _REMAP_SIDECAR = ".unsloth_sandbox_remap.json"
+_BLOCKED_NETWORK_MODULES = frozenset({"boto3", "botocore"})
+# httpx imports httpcore internally, so block only sandbox-user requests.
+_DIRECT_BLOCKED_NETWORK_MODULES = frozenset({"httpcore"})
+_import_guard_installed = False
+_original_import = builtins.__import__
+_original_import_module = importlib.import_module
+
+
+def _path_is_in_sandbox(filename):
+    if not isinstance(filename, str) or filename.startswith("<"):
+        return False
+    try:
+        cwd = os.path.realpath(os.getcwd())
+        path = os.path.realpath(filename)
+        return os.path.commonpath((cwd, path)) == cwd
+    except (OSError, ValueError):
+        return False
+
+
+def _sandbox_code_requested_import():
+    try:
+        frame = sys._getframe(1)
+    except ValueError:
+        return True
+    while frame is not None:
+        module = frame.f_globals.get("__name__", "")
+        if (
+            module == __name__
+            or module == "importlib"
+            or module.startswith("importlib.")
+            or module.startswith("_frozen_importlib")
+        ):
+            frame = frame.f_back
+            continue
+        if module == "__main__" or _path_is_in_sandbox(frame.f_globals.get("__file__")):
+            return True
+        return False
+    return True
+
+
+def _blocked_network_module(fullname):
+    if not isinstance(fullname, str):
+        return None
+    root = fullname.split(".", 1)[0]
+    if root in _BLOCKED_NETWORK_MODULES:
+        return root
+    if root in _DIRECT_BLOCKED_NETWORK_MODULES and _sandbox_code_requested_import():
+        return root
+    return None
+
+
+def _raise_blocked_network_module(root):
+    raise ModuleNotFoundError(
+        f"Blocked: low-level network module {root!r} is unavailable in sandboxed code"
+    )
+
+
+def _absolute_import_name(
+    name,
+    package = None,
+    level = 0,
+):
+    if not isinstance(name, str):
+        return name
+    if level:
+        if not isinstance(package, str) or not package:
+            return name
+        relative = "." * level + name
+    elif name.startswith(".") and isinstance(package, str) and package:
+        relative = name
+    else:
+        return name
+    try:
+        return importlib.util.resolve_name(relative, package)
+    except (ImportError, ValueError):
+        return name
+
+
+def _guarded_import(
+    name,
+    globals = None,
+    locals = None,
+    fromlist = (),
+    level = 0,
+):
+    package = globals.get("__package__") if isinstance(globals, dict) else None
+    root = _blocked_network_module(_absolute_import_name(name, package, level))
+    if root is not None:
+        _raise_blocked_network_module(root)
+    return _original_import(name, globals, locals, fromlist, level)
+
+
+def _guarded_import_module(name, package = None):
+    root = _blocked_network_module(_absolute_import_name(name, package))
+    if root is not None:
+        _raise_blocked_network_module(root)
+    return _original_import_module(name, package)
+
+
+def _network_import_audit(event, args):
+    if event != "import" or not args:
+        return
+    root = _blocked_network_module(args[0])
+    if root is not None:
+        _raise_blocked_network_module(root)
+
+
+class _BlockedNetworkModuleFinder:
+    _unsloth_blocked_network_guard = True
+
+    def find_spec(
+        self,
+        fullname,
+        path = None,
+        target = None,
+    ):
+        root = _blocked_network_module(fullname)
+        if root is not None:
+            _raise_blocked_network_module(root)
+        return None
+
+
+def _install_import_guard():
+    global _import_guard_installed
+    if os.environ.get("UNSLOTH_STUDIO_SANDBOXED") != "1":
+        return
+    if not _import_guard_installed:
+        sys.addaudithook(_network_import_audit)
+        builtins.__import__ = _guarded_import
+        importlib.import_module = _guarded_import_module
+        _import_guard_installed = True
+    if any(getattr(finder, "_unsloth_blocked_network_guard", False) for finder in sys.meta_path):
+        return
+    sys.meta_path.insert(0, _BlockedNetworkModuleFinder())
 
 
 def _note(subject, original, mapped):
@@ -307,6 +443,11 @@ def _path_mkdir(self, *args, **kwargs):
     pathlib.Path.mkdir = _path_mkdir
 
 
+try:
+    _install_import_guard()
+except Exception:  # noqa: BLE001 - a broken guard must not break startup
+    pass
+
 try:
     _install()
 except Exception:  # noqa: BLE001 - a broken shim must never break user code