The dlsym operation generally (e.g. when done through a ctypes.CDLL object) triggers the "ctypes.dlsym" audit event. However, using _ctypes.dlsym directly does not trigger this event. This appears to be an oversight, given that _ctypes.dlopen *does* trigger the "ctypes.dlopen" audit event.A (very minimal) patch is attached.I was not entirely sure what format the DLL handle should take when it is passed to the audit function, so for now it just turns it back into a number via PyLong_FromVoidPtr (i.e. into the same format in which it is passed into _ctypes.dlsym in the first place).

I probably should have done this earlier, but here's a small test case that reproduces the issue. The assert fails in vanilla Python 3.8, but passes with the patch.

Thanks! Would you like to create a PR on GitHub for this? Or are you happy for me to do it.

Actually, it looks like we need to add events for many of the _ctypes functions, so I'll go through and do them.

New changeset00923c63995e34cdc25d699478f113de99a69df9 by Steve Dower in branch 'master':bpo-38622: Add missing audit events for ctypes module (GH-17158)https://github.com/python/cpython/commit/00923c63995e34cdc25d699478f113de99a69df9

Typically, as soon as I merge, I spot an edge case issue.PySys_Audit(n, "O", a) is deliberately going to treat 'a' as the tuple of arguments (when it is a tuple). This lets us simplify/optimise events where the event arguments match the function arguments exactly. If 'a' is not a tuple, it gets wrapped in one.When 'a' is meant to be a single argument that _might_ be a tuple, such as in PyObj_FromPtr, the format string needs to be "(O)" to ensure it is treated as a one element tuple. This is just how Py_BuildValue works - multiple elements become a tuple and the parens are optional unless you want a one-element tuple.

New changeset47db7439dd858c3634212c71137eb130f811bda4 by Miss Islington (bot) in branch '3.8':bpo-38622: Add missing audit events for ctypes module (GH-17158)https://github.com/python/cpython/commit/47db7439dd858c3634212c71137eb130f811bda4

New changesetdcf1f83de8678b09df5bd7d04ca5f4ef1cd02aca by Steve Dower in branch 'master':bpo-38622: Ensure ctypes.PyObj_FromPtr audit event passes tuples as a single argument (GH-17243)https://github.com/python/cpython/commit/dcf1f83de8678b09df5bd7d04ca5f4ef1cd02aca

New changesetbec7015dcc421a68cde030c5e4ca8e28408ef52d by Miss Islington (bot) in branch '3.8':bpo-38622: Ensure ctypes.PyObj_FromPtr audit event passes tuples as a single argument (GH-17243)https://github.com/python/cpython/commit/bec7015dcc421a68cde030c5e4ca8e28408ef52d