Issue #16400: Add command line option for isolated mode.

 -I

    Run Python in isolated mode. This also implies -E and -s. In isolated mode
    sys.path contains neither the script’s directory nor the user’s
    site-packages directory. All PYTHON* environment variables are ignored,
    too. Further restrictions may be imposed to prevent the user from
    injecting malicious code.

3 files changed, 22 insertions, 4 deletions

diff --git a/Doc/c-api/init.rst b/Doc/c-api/init.rst
index 6f847d9..32007d5 100644
--- a/Doc/c-api/init.rst
+++ b/Doc/c-api/init.rst
@@ -329,7 +329,11 @@ Process-wide parameters
 
 .. c:function:: void PySys_SetArgv(int argc, wchar_t **argv)
 
-   This function works like :c:func:`PySys_SetArgvEx` with *updatepath* set to 1.
+   This function works like :c:func:`PySys_SetArgvEx` with *updatepath* set
+   to 1 unless the :program:`python` interpreter was started with the
+   :option:`-I`.
+
+   .. versionchanged:: 3.4 The *updatepath* value depends on :option:`-I`.
 
 
 .. c:function:: void Py_SetPythonHome(wchar_t *home)
diff --git a/Doc/using/cmdline.rst b/Doc/using/cmdline.rst
index a7273bc..c14f6c7 100644
--- a/Doc/using/cmdline.rst
+++ b/Doc/using/cmdline.rst
@@ -24,7 +24,7 @@ Command line
 
 When invoking Python, you may specify any of these options::
 
-    python [-bBdEhiOqsSuvVWx?] [-c command | -m module-name | script | - ] [args]
+    python [-bBdEhiIOqsSuvVWx?] [-c command | -m module-name | script | - ] [args]
 
 The most common use case is, of course, a simple invocation of a script::
 
@@ -175,6 +175,8 @@ Generic options
        Python 3.0
 
 
+.. _using-on-misc-options:
+
 Miscellaneous options
 ~~~~~~~~~~~~~~~~~~~~~
 
@@ -213,6 +215,17 @@ Miscellaneous options
    raises an exception.  See also :envvar:`PYTHONINSPECT`.
 
 
+.. cmdoption:: -I
+
+   Run Python in isolated mode. This also implies -E and -s.
+   In isolated mode :data:`sys.path` contains neither the script's directory nor
+   the user's site-packages directory. All :envvar:`PYTHON*` environment
+   variables are ignored, too. Further restrictions may be imposed to prevent
+   the user from injecting malicious code.
+
+   .. versionadded:: 3.4
+
+
 .. cmdoption:: -O
 
    Turn on basic optimizations.  This changes the filename extension for
@@ -398,7 +411,7 @@ Environment variables
 ---------------------
 
 These environment variables influence Python's behavior, they are processed
-before the command-line switches other than -E.  It is customary that
+before the command-line switches other than -E or -I.  It is customary that
 command-line switches override environmental variables where there is a
 conflict.
 
diff --git a/Doc/whatsnew/3.4.rst b/Doc/whatsnew/3.4.rst
index 6011f8e..0333c11 100644
--- a/Doc/whatsnew/3.4.rst
+++ b/Doc/whatsnew/3.4.rst
@@ -107,7 +107,8 @@ Significantly Improved Library Modules:
 
 Security improvements:
 
-* None yet.
+* command line option for :ref:`isolated mode <using-on-misc-options>`,
+  :issue:`16499`.
 
 Please read on for a comprehensive list of user-facing changes.