@@ -624,3 +624,58 @@ To inject and execute a Python script in a remote process:
6246246. Set ``_PY_EVAL_PLEASE_STOP_BIT `` in the ``eval_breaker `` field.
6256257. Resume the process (if suspended). The script will execute at the next safe
626626 evaluation point.
627+
628+ .. _remote-debugging-threat-model :
629+
630+ Security and threat model
631+ =========================
632+
633+ The remote debugging protocol relies on the same operating system primitives
634+ used by native debuggers such as GDB and LLDB. Attaching to a process
635+ requires the **same privileges ** that those debuggers require, for example
636+ ``ptrace `` / Yama LSM on Linux, ``task_for_pid `` on macOS, and
637+ ``SeDebugPrivilege `` on Windows. Python does not introduce any new privilege
638+ escalation path; if an attacker already possesses the permissions needed to
639+ attach to a process, they could equally use GDB to read memory or inject
640+ code.
641+
642+ The following principles define what is, and is not, considered a security
643+ vulnerability in this feature:
644+
645+ Attaching requires OS-level privileges
646+ On every supported platform the operating system gates cross-process
647+ memory access behind privilege checks (``CAP_SYS_PTRACE ``, root, or
648+ administrator rights). A report that demonstrates an issue only after
649+ these privileges have already been obtained is **not ** a vulnerability in
650+ CPython, since the OS security boundary was already crossed.
651+
652+ Crashes or memory errors when reading a compromised process are not vulnerabilities
653+ A tool that reads internal interpreter state from a target process must
654+ trust that memory to be well-formed. If the target process has been
655+ corrupted or is controlled by an attacker, the debugger or profiler may
656+ crash, produce garbage output, or behave unpredictably. This is the same
657+ risk accepted by every ``ptrace ``-based debugger. Bugs in this category
658+ (buffer overflows, segmentation faults, or undefined behaviour triggered
659+ by reading corrupted state) are **not ** treated as security issues, though
660+ fixes that improve robustness are welcome.
661+
662+ Vulnerabilities in the target process are not in scope
663+ If the Python process being debugged has already been compromised, the
664+ attacker already controls execution in that process. Demonstrating further
665+ impact from that starting point does not constitute a vulnerability in the
666+ remote debugging protocol.
667+
668+ When to use ``PYTHON_DISABLE_REMOTE_DEBUG ``
669+ -------------------------------------------
670+
671+ The environment variable :envvar: `PYTHON_DISABLE_REMOTE_DEBUG ` (and the
672+ equivalent :option: `-X disable_remote_debug ` flag) allows operators to disable
673+ the in-process side of the protocol as a **defence-in-depth ** measure. This
674+ may be useful in hardened or sandboxed deployment environments where no
675+ debugging or profiling of the process is expected and reducing attack surface
676+ is a priority, even though the OS-level privilege checks already prevent
677+ unprivileged access.
678+
679+ Setting this variable does **not ** affect other OS-level debugging interfaces
680+ (``ptrace ``, ``/proc ``, ``task_for_pid ``, etc.), which remain available
681+ according to their own permission models.
![pydoc-zh-tw[bot]](https://avatars.githubusercontent.com/in/137018?v=4&size=40){kind=avatar}
0 commit comments