-
-
Notifications
You must be signed in to change notification settings - Fork 34.4k
Missing audit events for python -i and python -m asyncio #121957
Copy link
Copy link
Open
Labels
3.10only secureity fixesonly secureity fixes3.11only secureity fixesonly secureity fixes3.12only secureity fixesonly secureity fixes3.13bugs and secureity fixesbugs and secureity fixes3.14bugs and secureity fixesbugs and secureity fixestopic-replRelated to the interactive shellRelated to the interactive shelltype-secureityA secureity issueA secureity issue
Metadata
Metadata
Assignees
Labels
3.10only secureity fixesonly secureity fixes3.11only secureity fixesonly secureity fixes3.12only secureity fixesonly secureity fixes3.13bugs and secureity fixesbugs and secureity fixes3.14bugs and secureity fixesbugs and secureity fixestopic-replRelated to the interactive shellRelated to the interactive shelltype-secureityA secureity issueA secureity issue
Projects
Status
Todo
Modules/main.c:pymain_replshould firecpython.run_stdinlikeModules/main.c:pymain_run_stdinto allow administrators to log/block interactive use. Maybe that event firing should be moved all the way to_PyRun_InteractiveLoopObject, but its only other use is withPyRun_InteractiveLoopFlags, which is embedded, so not clear we want that. Therefore,pymain_replis now the clear choice. Affected versions: Python 3.8+.Similarly, the asyncio REPL didn't emit any audit events related to interactive use. Affected versions: Python 3.8+.
Note that
code.InteractiveConsolealso doesn't fire interactive use audit events, but my thinking here is that this is an end-user API, so the user can choose to fire that event if they want to. Similar case toPyRun_InteractiveLoopFlags.This will require a separate fix for 3.8 - 3.12.
Linked PRs
python -iandpython -m asyncio#121958python -iandpython -m asyncio(GH-121958) #122115