python - 如何为环境禁用 `site.ENABLE_USER_SITE`？

Question

来自 the docs :

site.ENABLE_USER_SITE

Flag showing the status of the user site-packages directory. True means that it is enabled and was added to sys.path. False means that it was disabled by user request (with -s or PYTHONNOUSERSITE). None means it was disabled for security reasons (mismatch between user or group id and effective id) or by an administrator.

我对 or by an administrator 这句话特别感兴趣。在我作为管理员(即我自己的机器)的机器上，如何针对特定的解释器可执行文件全局禁用此选项？

我想这样做的原因是新的 conda 环境启用了这个:https://github.com/conda/conda/issues/448

Answer 1

该变量的值完全在 Python code 中确定:

def check_enableusersite():
    """Check if user site directory is safe for inclusion

    The function tests for the command line flag (including environment var),
    process uid/gid equal to effective uid/gid.

    None: Disabled for security reasons
    False: Disabled by user (command line option)
    True: Safe and enabled
    """
    if sys.flags.no_user_site:
        return False

    if hasattr(os, "getuid") and hasattr(os, "geteuid"):
        # check process uid == effective uid
        if os.geteuid() != os.getuid():
            return None
    if hasattr(os, "getgid") and hasattr(os, "getegid"):
        # check process gid == effective gid
        if os.getegid() != os.getgid():
            return None

    return True

第一个测试只是针对 -s 开关或使用了 PYTHONNOUSERSITE 环境变量。

如果有效用户 ID 或组 ID 与进程用户 ID 或组 ID 不同，剩下的就是返回 None 的测试。

管理员可以 set the effective user id or group id bits ，此时可执行文件的有效用户更改为可执行文件的所有者或组，而不是执行 Python 的用户，此时上述函数将返回 None。

除此之外，sitecustomize.py 包可以再次将值设置为None，并再次明确地从路径中删除用户目录。如果是，则跳过 usercustomize.py 导入步骤。