The dlsym operation generally (e.g. when done through a ctypes.CDLL object) triggers the "ctypes.dlsym" audit event. However, using _ctypes.dlsym directly does not trigger this event. This appears to be an oversight, given that _ctypes.dlopen *does* trigger the "ctypes.dlopen" audit event.

A (very minimal) patch is attached.

I was not entirely sure what format the DLL handle should take when it is passed to the audit function, so for now it just turns it back into a number via PyLong_FromVoidPtr (i.e. into the same format in which it is passed into _ctypes.dlsym in the first place).

I probably should have done this earlier, but here's a small test case that reproduces the issue. The assert fails in vanilla Python 3.8, but passes with the patch.

Thanks! Would you like to create a PR on GitHub for this? Or are you happy for me to do it.

Actually, it looks like we need to add events for many of the _ctypes functions, so I'll go through and do them.

New changeset 00923c63995e34cdc25d699478f113de99a69df9 by Steve Dower in branch 'master':
bpo-38622: Add missing audit events for ctypes module (GH-17158)
https://github.com/python/cpython/commit/00923c63995e34cdc25d699478f113de99a69df9

Typically, as soon as I merge, I spot an edge case issue.

PySys_Audit(n, "O", a) is deliberately going to treat 'a' as the tuple of arguments (when it is a tuple). This lets us simplify/optimise events where the event arguments match the function arguments exactly. If 'a' is not a tuple, it gets wrapped in one.

When 'a' is meant to be a single argument that _might_ be a tuple, such as in PyObj_FromPtr, the format string needs to be "(O)" to ensure it is treated as a one element tuple. This is just how Py_BuildValue works - multiple elements become a tuple and the parens are optional unless you want a one-element tuple.

New changeset 47db7439dd858c3634212c71137eb130f811bda4 by Miss Islington (bot) in branch '3.8':
bpo-38622: Add missing audit events for ctypes module (GH-17158)
https://github.com/python/cpython/commit/47db7439dd858c3634212c71137eb130f811bda4

New changeset dcf1f83de8678b09df5bd7d04ca5f4ef1cd02aca by Steve Dower in branch 'master':
bpo-38622: Ensure ctypes.PyObj_FromPtr audit event passes tuples as a single argument (GH-17243)
https://github.com/python/cpython/commit/dcf1f83de8678b09df5bd7d04ca5f4ef1cd02aca

New changeset bec7015dcc421a68cde030c5e4ca8e28408ef52d by Miss Islington (bot) in branch '3.8':
bpo-38622: Ensure ctypes.PyObj_FromPtr audit event passes tuples as a single argument (GH-17243)
https://github.com/python/cpython/commit/bec7015dcc421a68cde030c5e4ca8e28408ef52d