From 4113b11c9d10fffd8c2c887f1ce93fbd6bf9a4e2 Mon Sep 17 00:00:00 2001 From: "Gregory P. Smith" Date: Sun, 26 Apr 2026 00:33:07 +0000 Subject: [PATCH] Document that multiprocessing treats local same-user processes as trusted Clarify in the Authentication keys section that the authkey handshake covers Listener/Client (addressable endpoints) only, not the anonymous pipes behind Pipe() and Queue, and that isolation between same-user processes must be arranged at the OS level. --- Doc/library/multiprocessing.rst | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/Doc/library/multiprocessing.rst b/Doc/library/multiprocessing.rst index 3ceb5e717c4825..187143d02cd7bf 100644 --- a/Doc/library/multiprocessing.rst +++ b/Doc/library/multiprocessing.rst @@ -2917,6 +2917,16 @@ between themselves. Suitable authentication keys can also be generated by using :func:`os.urandom`. +This authentication protects :class:`Listener` and :func:`Client` connections, +which are reachable by address. It is not applied to the anonymous pipes +created by :func:`~multiprocessing.Pipe` or used internally by +:class:`~multiprocessing.Queue`. +:mod:`multiprocessing` treats all local processes running as the same user as +trusted; on most operating systems such processes can access each other's pipe +file descriptors regardless. Applications that require isolation between +processes of the same user must arrange it at the operating-system level -- +for example, by running workers under a different user account or in a sandbox. + Logging ^^^^^^^