Skip to content

Missing audit events for python -i and python -m asyncio #121957

Open
@ambv

Description

@ambv

Modules/main.c:pymain_repl should fire cpython.run_stdin like Modules/main.c:pymain_run_stdin to allow administrators to log/block interactive use. Maybe that event firing should be moved all the way to _PyRun_InteractiveLoopObject, but its only other use is with PyRun_InteractiveLoopFlags, which is embedded, so not clear we want that. Therefore, pymain_repl is now the clear choice. Affected versions: Python 3.8+.

Similarly, the asyncio REPL didn't emit any audit events related to interactive use. Affected versions: Python 3.8+.

Note that code.InteractiveConsole also doesn't fire interactive use audit events, but my thinking here is that this is an end-user API, so the user can choose to fire that event if they want to. Similar case to PyRun_InteractiveLoopFlags.

This will require a separate fix for 3.8 - 3.12.

Linked PRs

Metadata

Metadata

Assignees

Labels

3.10only security fixes3.11only security fixes3.12only security fixes3.13bugs and security fixes3.14new features, bugs and security fixes3.8 (EOL)end of life3.9only security fixestopic-replRelated to the interactive shelltype-securityA security issue

Projects

Status

Todo

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions