Skip to content

Commit b125c78

Browse files
committed
gh-135543: emit sys.remote_exec audit event when sys.remote_exec has been called
Signed-off-by: Manjusaka <me@manjusaka.me>
1 parent 81237fb commit b125c78

3 files changed

Lines changed: 10 additions & 0 deletions

File tree

Doc/library/sys.rst

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1933,6 +1933,11 @@ always available. Unless explicitly noted otherwise, all variables are read-only
19331933
interpreter is pre-release (alpha, beta, or release candidate) then the
19341934
local and remote interpreters must be the same exact version.
19351935

1936+
.. audit-event:: remove_exec pid script_path
1937+
1938+
When the code is executed in the remote process, an :ref:`auditing event <auditing>`
1939+
``remove_exec`` is raised with the *pid* and the path to the script file.
1940+
19361941
.. availability:: Unix, Windows.
19371942
.. versionadded:: 3.14
19381943

Lib/test/test_sys.py

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2118,6 +2118,7 @@ def audit_hook(event, arg):
21182118
self.assertEqual(returncode, 0)
21192119
self.assertIn(b"Remote script executed successfully!", stdout)
21202120
self.assertIn(b"Audit event: remote_debugger_script, arg: ", stdout)
2121+
self.assertIn(b"Audit event: remote_exec, arg: ", stdout)
21212122
self.assertEqual(stderr, b"")
21222123

21232124
def test_remote_exec_with_exception(self):

Python/sysmodule.c

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2485,6 +2485,10 @@ sys_remote_exec_impl(PyObject *module, int pid, PyObject *script)
24852485
PyObject *path;
24862486
const char *debugger_script_path;
24872487

2488+
if (PySys_Audit("remote_exec", "iO", pid, script) < 0) {
2489+
return NULL;
2490+
}
2491+
24882492
if (PyUnicode_FSConverter(script, &path) == 0) {
24892493
return NULL;
24902494
}

0 commit comments

Comments
 (0)