sys.executable is sometimes wrong

[tecki]

Bug report

Bug description:

On Linux, sys.executable is determined using argv[0], and trying to find that in the PATH. This presumes that the Python interpreter has been started by a shell that interprets PATH in the canonical way. There is no guarantee that this happens at all, so sys.executable may point to something completely different, or is even the empty string.

As an example:

bash -c 'exec -a whatever python -c "import sys;print(sys.executable)"'

should output the path of the Python executable, but simply outputs nothing.

Even worse, one can make Python output a wrong executable, as in

bash -c 'exec -a /usr/bin/python python -c "import sys;print(sys.executable)"'

CPython versions tested on:

CPython main branch

Operating systems tested on:

Linux

[skirpichev]

I can confirm first behaviour:

sk@note:~/src/peps $ which python
sk@note:~/src/peps $ which python3
/usr/local/bin/python3
sk@note:~/src/peps $ bash -c 'exec -a whatever python3 -c "import sys;print(sys.executable)"'

But not the second:

$ bash -c 'exec -a /usr/local/bin/python3 python3 -c "import sys;print(sys.executable)"'
/usr/local/bin/python3

Could you, please, show us output of which python?

Anyway, this seems to be documented: "If Python is unable to retrieve the real path to its executable, sys.executable will be an empty string or None."

Meanwhile, I'll relabel your issue as a feature request.

[ZeroIntensity]

@skirpichev, maybe this is a permissions issue? I'm on a root user, and I was able to reproduce the second behavior. Running the following on my results in /usr/bin/echo being printed:

$ bash -c 'exec -a echo python3 -c "import sys;print(sys.executable)"'
/usr/bin/echo

Interestingly, running it with a path that doesn't exist results in a fatal error:

$ bash -c 'exec -a evil python3 -c "import sys;print(sys.executable)"'
Fatal Python error: init_fs_encoding: failed to get the Python codec of the filesystem encoding
Python runtime state: core initialized
ModuleNotFoundError: No module named 'encodings'

Current thread 0x00007f8899f14080 (most recent call first):
  <no Python frame>

Injection of arbitrary files into sys.executable seems like a security problem to me (but maybe not if this only occurs on root users).

[skirpichev]

maybe this is a permissions issue?

Maybe PATH settings?

That does work for me and doesn't look right:

$ bash -c 'exec -a /usr/bin/evil python3 -c "import sys;print(sys.executable)"'
/usr/bin/evil

Edit:

Perhaps, this should mentioned somehow in docs.

Injection of arbitrary files into sys.executable seems like a security problem

I doubt you can do too much with this mechanism. Unless there are other options to override arg0. There are e.g. various exec*() calls in POSIX, but it's essentially same. Yes, you can abuse mechanism for yourself (regardless on your rights), but what you gain? I doubt this will be a security issue without decent part of social engineering;)

[ZeroIntensity]

I could see it being a problem for applications that use subprocess.blah_blah([sys.executable, "..."))

It's not a terrible vulnerability, but e.g. a user on a Linux machine owned by their company could use it to mess with whatever software the employer has installed to their computer. (Kind of a bad example, but you get the general idea.)

[skirpichev]

But what evil you could do with this, assuming you can point sys.executable to an arbitrary file? Company software will execute one?

Wait, but that means that someone else put in system some file, that you already can run (suitable permissions, including executable bit). Then why not run directly?

[ZeroIntensity]

Possibly, I'm just speculating 😃

Regardless, this is a bug. I think we should try to stop sys.executable from holding the wrong thing, rather than just documenting it.

[skirpichev]

I think we should try to stop sys.executable from holding the wrong thing

I don't know universal ways to do so. E.g. on Linux (and I think BSD nowadays), you can use /proc//exe symlink.

[ZeroIntensity]

I don't know universal ways to do so.

Me neither. But I'm not too sure who to CC on this. I guess if this only affects Linux then /proc/exe should work.

[skirpichev]

I guess if this only affects Linux

No, I think it should affect any system with POSIX exec*() functions, for example.