Restrict python script locations

问题:

I'm wondering if there is a way of controlling from where python scripts are allowed to run? So that only scripts in certain locations are allowed to be run by python. We are running a windows environment with windows domain controllers.

The reason being as one step of locking down python in an environment with strict security requirements.

回答1:

Given a set of directories whose contents should be excluded from execution by the Python interpreter - maybe you could strip the execute execute access rights from each of the Python scripts in question, maybe using access control lists) - see https://docs.microsoft.com/en-us/windows/desktop/secauthz/access-control-lists for details.

Alternatively, perhaps you define a list of white-listed directories, and modify the scripts such that they check to see where they are physically located, exiting immediately after execution if they are not in a white-listed directory. This is admittedly not the most extensible approach and probably won't fly.