add audit hook for fs, network and processes

This commit is contained in:
Ian Chua
2026-08-13 19:16:18 +08:00
parent 35970f61dc
commit ddd62e25df
6 changed files with 424 additions and 97 deletions
-4
View File
@@ -628,10 +628,6 @@ bool PythonInterpreter::initialize()
else
BOOST_LOG_TRIVIAL(info) << "Bundled uv executable not found";
// Install the CPython audit hook for plugin policy enforcement.
// This is defense-in-depth: today it only inspects the `open` audit event
// and blocks writes outside the allowed roots; subprocess/socket/ctypes and
// other events are not yet handled. It is NOT a full security sandbox.
PluginAuditManager::instance().install_hook();
// Persist Python stderr (plugin tracebacks, including uncaught