gh-149473: Emit audit event on calling os.environ.clear()#149768
gh-149473: Emit audit event on calling os.environ.clear()#149768vstinner wants to merge 2 commits into
Conversation
|
cc @picnixz |
Documentation build overview
6 files changed ·
|
| @@ -0,0 +1,2 @@ | |||
| Calling ``os.environ.clear()`` now emits ``os._clearenv`` auditing event. | |||
There was a problem hiding this comment.
The event is only emitted if we use the C implementation right? Otherwise os.environ.clear() is implemented in pure Python. I don't know if you want to update the Python implementation as well though.
There was a problem hiding this comment.
If os._clearenv() is not available, os.environ.clear() emits one audit event os.unsetenv per removed variable. Example:
import os, sys
os.environ.clear()
os.environ['key1'] = 'value1'
os.environ['key2'] = 'value2'
def hook(*args):
print("audit:", args)
sys.addaudithook(hook)
os.environ.clear()Output with os._clearenv() and this change:
audit: ('os._clearenv', ())
Output without os._clearenv():
audit: ('os.unsetenv', (b'key1',))
audit: ('os.unsetenv', (b'key2',))
There was a problem hiding this comment.
I think this should be explicitly documented actually. With the new docs, I think people could expect os.environ.clear() to emit _clearenv unconditionally. I also see that we say that unsetenv is called whenever we call os.environ.clear() but that's not entirely accurate either.
There was a problem hiding this comment.
I updated the PR to add a paragraph explaining exactly which audit events are emitted by os.environ.clear(). Is it explicit enough to you?
| :data:`os.environ`, and when one of the :meth:`~dict.pop` or | ||
| :meth:`~dict.clear` methods is called. | ||
|
|
||
| If the ``clearenv()`` function is available, the :meth:`~dict.clear` method |
There was a problem hiding this comment.
| If the ``clearenv()`` function is available, the :meth:`~dict.clear` method | |
| If the :manpage:`clearenv(3)` function is available, the :meth:`~dict.clear` method |
Uh oh!
There was an error while loading. Please reload this page.