diff --git a/Doc/library/os.rst b/Doc/library/os.rst index 371d59e9c31a45..bf1cda29b06984 100644 --- a/Doc/library/os.rst +++ b/Doc/library/os.rst @@ -3871,6 +3871,8 @@ written in Python, such as a mail server's external command delivery program. See the :manpage:`pidfd_open(2)` man page for more details. + .. audit-event:: os.pidfd_open pid,flags os.pidfd_open + .. availability:: Linux 5.3+ .. versionadded:: 3.9 diff --git a/Doc/library/signal.rst b/Doc/library/signal.rst index 84a569d03eb293..07f7c60705ec94 100644 --- a/Doc/library/signal.rst +++ b/Doc/library/signal.rst @@ -360,6 +360,8 @@ The :mod:`signal` module defines the following functions: See the :manpage:`pidfd_send_signal(2)` man page for more information. + .. audit-event:: signal.pidfd_send_signal pidfd,sig,siginfo,flags signal.pidfd_send_signal + .. availability:: Linux 5.1+ .. versionadded:: 3.9 diff --git a/Misc/NEWS.d/next/Security/2021-04-21-18-04-12.bpo-38692.Arq9me.rst b/Misc/NEWS.d/next/Security/2021-04-21-18-04-12.bpo-38692.Arq9me.rst new file mode 100644 index 00000000000000..90d88953fa51eb --- /dev/null +++ b/Misc/NEWS.d/next/Security/2021-04-21-18-04-12.bpo-38692.Arq9me.rst @@ -0,0 +1,2 @@ +Add audit events to :func:`os.pidfd_open` and +:func:`signal.pidfd_send_signal`. diff --git a/Modules/posixmodule.c b/Modules/posixmodule.c index 8ce62c88216e3d..f31e2b639f1f5a 100644 --- a/Modules/posixmodule.c +++ b/Modules/posixmodule.c @@ -8485,6 +8485,9 @@ static PyObject * os_pidfd_open_impl(PyObject *module, pid_t pid, unsigned int flags) /*[clinic end generated code: output=5c7252698947dc41 input=c3fd99ce947ccfef]*/ { + if (PySys_Audit("os.pidfd_open", "iI", pid, flags) < 0) { + return NULL; + } int fd = syscall(__NR_pidfd_open, pid, flags); if (fd < 0) { return posix_error(); diff --git a/Modules/signalmodule.c b/Modules/signalmodule.c index 98a938f1976735..c7c157bbd0cf04 100644 --- a/Modules/signalmodule.c +++ b/Modules/signalmodule.c @@ -1305,6 +1305,10 @@ signal_pidfd_send_signal_impl(PyObject *module, int pidfd, int signalnum, PyErr_SetString(PyExc_TypeError, "siginfo must be None"); return NULL; } + if (PySys_Audit("signal.pidfd_send_signal", "iiOi", pidfd, signalnum, + siginfo, flags) < 0) { + return NULL; + } if (syscall(__NR_pidfd_send_signal, pidfd, signalnum, NULL, flags) < 0) { PyErr_SetFromErrno(PyExc_OSError); return NULL;