openedx / openedx/codejail

Can we prevent Python from importing sitecustomize.py?

Open
#9 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
479
Forks
84
Avg merge
16h 34m
Merged PRs (30d)
2

Description

On Ubuntu, sitecustomize.py is linked to /etc/python2.7/sitecustomize.py, which tries to import apport_python_hook. This fails due to the AppArmor profile, but I would rather not import it at all.

I tried writing an empty sitecustomize.py into the sandbox directory, but it didn't get imported, not sure why.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

The issue names no repository file or test entry point. Start by reproducing Python 2.7 startup in the Ubuntu sandbox and inspect how sitecustomize.py and AppArmor interact. Done means the sandbox avoids importing the system sitecustomize.py and no longer triggers the apport_python_hook failure.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
operating-systems, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.