Skip to content

Missing audit events for python -i and python -m asyncio #121957

Description

@ambv

Modules/main.c:pymain_repl should fire cpython.run_stdin like Modules/main.c:pymain_run_stdin to allow administrators to log/block interactive use. Maybe that event firing should be moved all the way to _PyRun_InteractiveLoopObject, but its only other use is with PyRun_InteractiveLoopFlags, which is embedded, so not clear we want that. Therefore, pymain_repl is now the clear choice. Affected versions: Python 3.8+.

Similarly, the asyncio REPL didn't emit any audit events related to interactive use. Affected versions: Python 3.8+.

Note that code.InteractiveConsole also doesn't fire interactive use audit events, but my thinking here is that this is an end-user API, so the user can choose to fire that event if they want to. Similar case to PyRun_InteractiveLoopFlags.

This will require a separate fix for 3.8 - 3.12.

Linked PRs

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

3.10 (EOL)end of life3.11only security fixes3.12only security fixes3.13only security fixes3.14bugs and security fixestopic-replRelated to the interactive shelltype-securityA security issue

Projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions