sync with cpython f4c9bc89

Author: github-actions[bot]

howto/remote_debugging.po

@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: Python 3.14\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-01-22 16:08+0000\n"
+"POT-Creation-Date: 2026-04-04 00:21+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: Chinese - TAIWAN (https://github.com/python/python-docs-zh-"
@@ -47,7 +47,8 @@ msgid ""
 "Set the :envvar:`PYTHON_DISABLE_REMOTE_DEBUG` environment variable to ``1`` "
 "before starting the interpreter."
 msgstr ""
-"在啟動直譯器之前，將 :envvar:`PYTHON_DISABLE_REMOTE_DEBUG` 環境變數設為 ``1``。"
+"在啟動直譯器之前，將 :envvar:`PYTHON_DISABLE_REMOTE_DEBUG` 環境變數設為 "
+"``1``。"
 
 #: ../../howto/remote_debugging.rst:18
 msgid "Use the :option:`-X disable_remote_debug` command-line option."
@@ -1323,3 +1324,90 @@ msgid ""
 "Resume the process (if suspended). The script will execute at the next safe "
 "evaluation point."
 msgstr "恢復行程（如果已暫停）。腳本將在下一個安全執行點執行。"
+
+#: ../../howto/remote_debugging.rst:631
+msgid "Security and threat model"
+msgstr ""
+
+#: ../../howto/remote_debugging.rst:633
+msgid ""
+"The remote debugging protocol relies on the same operating system primitives "
+"used by native debuggers such as GDB and LLDB.  Attaching to a process "
+"requires the **same privileges** that those debuggers require, for example "
+"``ptrace`` / Yama LSM on Linux, ``task_for_pid`` on macOS, and "
+"``SeDebugPrivilege`` on Windows.  Python does not introduce any new "
+"privilege escalation path; if an attacker already possesses the permissions "
+"needed to attach to a process, they could equally use GDB to read memory or "
+"inject code."
+msgstr ""
+
+#: ../../howto/remote_debugging.rst:642
+msgid ""
+"The following principles define what is, and is not, considered a security "
+"vulnerability in this feature:"
+msgstr ""
+
+#: ../../howto/remote_debugging.rst:645
+msgid "Attaching requires OS-level privileges"
+msgstr ""
+
+#: ../../howto/remote_debugging.rst:646
+msgid ""
+"On every supported platform the operating system gates cross-process memory "
+"access behind privilege checks (``CAP_SYS_PTRACE``, root, or administrator "
+"rights).  A report that demonstrates an issue only after these privileges "
+"have already been obtained is **not** a vulnerability in CPython, since the "
+"OS security boundary was already crossed."
+msgstr ""
+
+#: ../../howto/remote_debugging.rst:652
+msgid ""
+"Crashes or memory errors when reading a compromised process are not "
+"vulnerabilities"
+msgstr ""
+
+#: ../../howto/remote_debugging.rst:653
+msgid ""
+"A tool that reads internal interpreter state from a target process must "
+"trust that memory to be well-formed.  If the target process has been "
+"corrupted or is controlled by an attacker, the debugger or profiler may "
+"crash, produce garbage output, or behave unpredictably.  This is the same "
+"risk accepted by every ``ptrace``-based debugger.  Bugs in this category "
+"(buffer overflows, segmentation faults, or undefined behaviour triggered by "
+"reading corrupted state) are **not** treated as security issues, though "
+"fixes that improve robustness are welcome."
+msgstr ""
+
+#: ../../howto/remote_debugging.rst:662
+msgid "Vulnerabilities in the target process are not in scope"
+msgstr ""
+
+#: ../../howto/remote_debugging.rst:663
+msgid ""
+"If the Python process being debugged has already been compromised, the "
+"attacker already controls execution in that process.  Demonstrating further "
+"impact from that starting point does not constitute a vulnerability in the "
+"remote debugging protocol."
+msgstr ""
+
+#: ../../howto/remote_debugging.rst:669
+msgid "When to use ``PYTHON_DISABLE_REMOTE_DEBUG``"
+msgstr ""
+
+#: ../../howto/remote_debugging.rst:671
+msgid ""
+"The environment variable :envvar:`PYTHON_DISABLE_REMOTE_DEBUG` (and the "
+"equivalent :option:`-X disable_remote_debug` flag) allows operators to "
+"disable the in-process side of the protocol as a **defence-in-depth** "
+"measure.  This may be useful in hardened or sandboxed deployment "
+"environments where no debugging or profiling of the process is expected and "
+"reducing attack surface is a priority, even though the OS-level privilege "
+"checks already prevent unprivileged access."
+msgstr ""
+
+#: ../../howto/remote_debugging.rst:679
+msgid ""
+"Setting this variable does **not** affect other OS-level debugging "
+"interfaces (``ptrace``, ``/proc``, ``task_for_pid``, etc.), which remain "
+"available according to their own permission models."
+msgstr ""