From: Victor Stinner <vstinner@python.org>
Date: Fri, 25 Apr 2025 16:30:39 +0000 (+0200)
Subject: gh-107954: Add audit event to PyConfig_Set() (#132958)
X-Git-Tag: v3.14.0b1~284
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=ac5424d6a9f5aa37432cbbf366745f708f44a8ec;p=thirdparty%2FPython%2Fcpython.git

gh-107954: Add audit event to PyConfig_Set() (#132958)
---

diff --git a/Doc/c-api/init_config.rst b/Doc/c-api/init_config.rst
index d8d442cff03f..bc5b236393be 100644
--- a/Doc/c-api/init_config.rst
+++ b/Doc/c-api/init_config.rst
@@ -619,6 +619,8 @@ Some options are read from the :mod:`sys` attributes. For example, the option
    The caller must have an :term:`attached thread state`. The function cannot
    be called before Python initialization nor after Python finalization.
 
+   .. audit-event:: cpython.PyConfig_Set name,value c.PyConfig_Set
+
    .. versionadded:: 3.14
 
 
diff --git a/Python/initconfig.c b/Python/initconfig.c
index 43b85a383d3b..7d3043dd5d1d 100644
--- a/Python/initconfig.c
+++ b/Python/initconfig.c
@@ -4539,6 +4539,10 @@ config_set_int_attr(const PyConfigSpec *spec, int value)
 int
 PyConfig_Set(const char *name, PyObject *value)
 {
+    if (PySys_Audit("cpython.PyConfig_Set", "sO", name, value) < 0) {
+        return -1;
+    }
+
     const PyConfigSpec *spec = config_find_spec(name);
     if (spec == NULL) {
         spec = preconfig_find_spec(name);