阻止嵌入式Python运行Shell命令？

Question

I want to embed Python 3.x in our C++ application to allow scripting of maintenance and other tasks. It so far does everything we need including file manipulation.

The problem is that to meet some specifications (like PCI), we aren't allowed to arbitrarily run shell commands such as with subprocess.call or popen.

Is there a way to prevent and similar calls from working in embedded Python?

Answer 1

一种选择是删除所有允许运行任意shell命令的模块，例如：subprocess.py *，os.py * ...，并仅包括允许最终用户立即访问的模块。

Answer 2

除非您的应用程序确实被锁定，否则我认为您无法阻止某人从任意目录（带有导入）加载其自己的python模块，因此，只要嵌入了python，我就无法阻止执行任意代码。