Minimal patch to secure the Python interpreter

Objects/genobject.c

Index: Objects/genobject.c
===================================================================
--- Objects/genobject.c	(revision 69906)
+++ Objects/genobject.c	(working copy)
@@ -312,9 +312,11 @@
 
 
 static PyMemberDef gen_memberlist[] = {
-	{"gi_frame",	T_OBJECT, offsetof(PyGenObject, gi_frame),	RO},
-	{"gi_running",	T_INT,    offsetof(PyGenObject, gi_running),	RO},
-        {"gi_code",     T_OBJECT, offsetof(PyGenObject, gi_code),  RO},
+	{"gi_frame",	T_OBJECT, offsetof(PyGenObject, gi_frame),
+	 RO|RESTRICTED},

[GvR, 2009/02/25 17:42:41]

Given the restrictions on frames, do you still need this?

[asktav, 2009/02/25 21:00:57]

Good point. But I'd like to keep this restriction in there, just in case...

+	{"gi_running",	T_INT,    offsetof(PyGenObject, gi_running), RO},
+	{"gi_code",     T_OBJECT, offsetof(PyGenObject, gi_code),
+	 RO|RESTRICTED},

[GvR, 2009/02/25 17:42:41]

Again, why do you restrict the code object?  (I guess I am arguing for lifting
the restriction on func_code/__code__ too. :-)

[asktav, 2009/02/25 21:00:57]

code_object.co_consts

 	{NULL}	/* Sentinel */
 };