-
-
Notifications
You must be signed in to change notification settings - Fork 31.2k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Missing audit events for python -i
and python -m asyncio
#121957
Labels
3.8 (EOL)
end of life
3.9
only security fixes
3.10
only security fixes
3.11
only security fixes
3.12
bugs and security fixes
3.13
bugs and security fixes
3.14
new features, bugs and security fixes
topic-repl
Related to the interactive shell
type-security
A security issue
Comments
ambv
added a commit
to ambv/cpython
that referenced
this issue
Jul 18, 2024
… with PyREPL Relatedly, emit the `cpython.run_startup` event from the Python version of `PYTHONSTARTUP` handling.
Modules/main.c:pymain_start_pyrepl_no_main
python -i
and python -m asyncio
ambv
added a commit
to ambv/cpython
that referenced
this issue
Jul 18, 2024
ambv
added a commit
to ambv/cpython
that referenced
this issue
Jul 22, 2024
ambv
added a commit
that referenced
this issue
Jul 22, 2024
…H-121958) Relatedly, emit the `cpython.run_startup` event from the Python version of `PYTHONSTARTUP` handling.
miss-islington
pushed a commit
to miss-islington/cpython
that referenced
this issue
Jul 22, 2024
…ncio` (pythonGH-121958) Relatedly, emit the `cpython.run_startup` event from the Python version of `PYTHONSTARTUP` handling. (cherry picked from commit dc93d11) Co-authored-by: Łukasz Langa <lukasz@langa.pl>
ambv
added a commit
to ambv/cpython
that referenced
this issue
Jul 22, 2024
ambv
added a commit
to ambv/cpython
that referenced
this issue
Jul 22, 2024
ambv
added a commit
to ambv/cpython
that referenced
this issue
Jul 22, 2024
ambv
added a commit
to ambv/cpython
that referenced
this issue
Jul 22, 2024
ambv
added a commit
to ambv/cpython
that referenced
this issue
Jul 22, 2024
ambv
added a commit
that referenced
this issue
Jul 22, 2024
ambv
added a commit
that referenced
this issue
Jul 22, 2024
ambv
added a commit
that referenced
this issue
Jul 22, 2024
ambv
added a commit
that referenced
this issue
Jul 22, 2024
The fix and backports landed, but I'm keeping this open, because I'd like to have a test of those audit events at least on |
ambv
added a commit
that referenced
this issue
Jul 22, 2024
arnout
pushed a commit
to buildroot/buildroot
that referenced
this issue
Aug 27, 2024
Fixes the following security issues: - gh-121957: Fixed missing audit events around interactive use of Python, now also properly firing for python -i, as well as for python -m asyncio. The event in question is cpython.run_stdin. python/cpython#121957 For more details, see the changelog: https://docs.python.org/release/3.12.5/whatsnew/changelog.html#python-3-12-5 Signed-off-by: Peter Korsgaard <peter@korsgaard.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Labels
3.8 (EOL)
end of life
3.9
only security fixes
3.10
only security fixes
3.11
only security fixes
3.12
bugs and security fixes
3.13
bugs and security fixes
3.14
new features, bugs and security fixes
topic-repl
Related to the interactive shell
type-security
A security issue
Modules/main.c:pymain_repl
should firecpython.run_stdin
likeModules/main.c:pymain_run_stdin
to allow administrators to log/block interactive use. Maybe that event firing should be moved all the way to_PyRun_InteractiveLoopObject
, but its only other use is withPyRun_InteractiveLoopFlags
, which is embedded, so not clear we want that. Therefore,pymain_repl
is now the clear choice. Affected versions: Python 3.8+.Similarly, the asyncio REPL didn't emit any audit events related to interactive use. Affected versions: Python 3.8+.
Note that
code.InteractiveConsole
also doesn't fire interactive use audit events, but my thinking here is that this is an end-user API, so the user can choose to fire that event if they want to. Similar case toPyRun_InteractiveLoopFlags
.This will require a separate fix for 3.8 - 3.12.
Linked PRs
python -i
andpython -m asyncio
#121958python -i
andpython -m asyncio
(GH-121958) #122115The text was updated successfully, but these errors were encountered: