pySCG: Python Hardening Guide: we should mention and explain audit hooks, sys.audit and sys.addaudithook

未关闭
  • 哪里不对？
#18 4 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

还没有人认领这个 Issue。

评估

难度
3/5
预计耗时
1-2 天
新手友好度
45/100
Issue 类型
文档
描述清晰度
基本清楚
活跃度
停滞
技术栈
python
领域
documentation, security

调研方向

Read the logging rules in the CWE-532 guideline linked from the issue and review PEP 578 alongside the example01.py example in the issue. Decide whether audit hooks should be explained in a log related rule and whether they help separate internal and user facing logs; done means the relevant guidance clearly explains the recommendation and its limits.

由索引模型根据 Issue 内容生成。

描述

sys.audit allows to create events that can be used during audits as demonstrated in example01.py
aduprocess.py Popen class has a line that creates an audit event looking like this:
sys.audit("subprocess.Popen", executable, args, cwd, env)

These type of events are Python internal and not handled unless there is a listener/hook.
The example01.py creates the audit method that is attached/hooked into the Python audit system via sys.addaudtihook(audit).
The audit method allows any sort of handling of an event including suppressing functions.

example01.py:

"""
Playing around with audit hooks
https://www.youtube.com/watch?v=sIibadhDqaw
https://github.com/ossf/wg-best-practices-os-developers/issues
"""
import sys
from typing import Any
import subprocess


def audit(event: str, args: tuple[Any, ...]) -> None:
    """ foo """
    # if "subprocess" in event:
    print("audit::", event, args)


sys.addaudithook(audit)

# compile(None, '<stdin>')
# print('hi')
subprocess.Popen(('echo', 'hi'))
import email

In our rules about logging we recommend to prevent sensitive information such as system internals to end-users. We recommend to split logging between internal and user facing. The use facing has sensitive system-internal information removed. Audit logs should be mentioned as part of one of the log related rules. We will need to investigate if the use of audit logs can be recommended to solve the issue around splitting back-ed, front-end.

related guideline:
PEP 578 – Python Runtime Audit Hooks
CWE-532: Insertion of Sensitive Information into Log File

主要语言
Python
星标
2
派生
2
平均合并
11 分钟
30 天内合并 PR
2

环境准备

  • 没有 Dockerfile 或 Docker Compose 文件
  • 没有 Pull Request 模板
  • 阅读贡献指南

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

ossf/python-secure-coding-guide 的其他 Issue

查看 ossf/python-secure-coding-guide 的全部 Issue

相似的 Issue

更多 Python Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。