CIS interferes in Blender's addons written in Python

1

EDIT: most recent observation

After working with Blender for a while, it seems some addons still don’t work. I can’t exactly understand what happens but every time I use one operator in Blender, new files of this form are generated:

C_python.exe_FD243E4545B32FF54FD7610C4E7314BB73AA5B62.py

These files contain just this line of Python code:

    from multiprocessing.spawn import spawn_main; spawn_main(parent_pid=13604, pipe_handle=4252)

where pipe_handle is different. The operator in Blender is blocked with the error PermissionDenied. Marking these files as Trusted didn’t work, I assume because these files are created on demand (?).

Since the previous solution had not worked, I simply created one exception for blender.exe in Auto-Containment, which stopped CIS from blocking addons.

I can’t say whether this is a proper solution to solve my problem.

Original post

I have a problem with Blender + CIS 2027.

Blender is a vastly modular program whose addons are coded in Python including code for running functions, and generating custom panels and other elements of UI.

As I understand, Python may execute harmful code and CIS run such scripts in contained environment, or simply virtually. I also understand, this is controlled by Settings → Analysis → Script Analysis (at least in the new CIS 2027). Without handling this, Blender addons simply do not function because scripts need to be executed correctly.

I have tried two approaches and both work. However, I’d like to ask if these approaches are OK, especially the second one or am I putting myself into troubles?

Disabling Python

First, I could simply disable both python.exe and pythonw.exe in Settings → Analysis → Script Analysis. This indeed sorts out the problem because Python CIS no longer handles scripts. Personally, I don’t like it.

Exception in Containment section

I realised CIS run each scripts virtually. Hence, in Containment Settings I thought I could add a folder containing addons to the list of Do not virtualise access to the specified files/folders.

The latter seems better because I can control or narrow folders that are ignored by CIS. Whereas there might still be a script somewhere in the system which can cause damage. The latter approach would also be great because I make addons by myself and would add my personal folder to exception and would not have to clear CIS every time I make changes.

Is there any better, or perhaps more secure way of doing this?

Thanks

2

Not sure if scan exclusions would work just for the Blender path where the script reside, or if it even interacts with Blender.

But yea, the generic script thing can be annoying.

I wonder if its possible to add a full path to the python version that blender uses and disable script analysis for THAT one, i.e. \program files\blender\bin\python.exe or something like that, which obviously means a LOLBIN could use that for its “fun”.

3

You could try adding it to Shell Code Exclusions under Miscellaneous settings

image
image1170×790 190 KB

4

Thanks guys,

Here’s the Blender’s path to Python

C:\Program Files\Blender Foundation\Blender 5.2\5.2\python

But I can’t see where I could disable its Python version. CIS is set to its default theme Dark Theme. In that, Script Analysis is a place where I can turn on/off python in general, without an option to add exceptions, at least that 's what it seems:

image
image2022×1637 205 KB

As mentioned, I only managed to have Blender working by adding path to Blender in Auto-Containment

image
image2046×1660 203 KB

@EricCryptid

What would you add there? Blender’s path or its Python version?