Skip to content

Commit 822686e

Browse files
committed
tmpdir: prevent using a non-private root temp directory
pytest uses a root temp directory named `/tmp/pytest-of-<username>`. The name is predictable, and the directory might already exists from a previous run, so that's allowed. This makes it possible for my_user to pre-create `/tmp/pytest-of-another_user`, thus giving my_user control of another_user's tempdir. Prevent this scenario by adding a couple of safety checks. I believe they are sufficient. Testing the first check requires changing the owner, which requires root permissions, so can't be unit-tested easily, but I checked it manually.
1 parent 9dc54f7 commit 822686e

File tree

3 files changed

+49
-0
lines changed

3 files changed

+49
-0
lines changed

changelog/8414.bugfix.rst

+5
Original file line numberDiff line numberDiff line change
@@ -3,3 +3,8 @@ permissions. This means that any user in the system was able to read
33
information written by tests in temporary directories (such as those created by
44
the ``tmp_path``/``tmpdir`` fixture). Now the directories are created with
55
private permissions.
6+
7+
pytest used silenty use a pre-existing ``/tmp/pytest-of-<username>`` directory,
8+
even if owned by another user. This means another user could pre-create such a
9+
directory and gain control of another user's temporary directory. Now such a
10+
condition results in an error.

src/_pytest/tmpdir.py

+19
Original file line numberDiff line numberDiff line change
@@ -115,6 +115,25 @@ def getbasetemp(self) -> Path:
115115
# make_numbered_dir() call
116116
rootdir = temproot.joinpath(f"pytest-of-{user}")
117117
rootdir.mkdir(mode=0o700, exist_ok=True)
118+
# Because we use exist_ok=True with a predictable name, make sure
119+
# we are the owners, to prevent any funny business (on unix, where
120+
# temproot is usually shared).
121+
# Also, to keep things private, fixup any world-readable temp
122+
# rootdir's permissions. Historically 0o755 was used, so we can't
123+
# just error out on this, at least for a while.
124+
if hasattr(os, "getuid"):
125+
rootdir_stat = rootdir.stat()
126+
uid = os.getuid()
127+
# getuid shouldn't fail, but cpython defines such a case.
128+
# Let's hope for the best.
129+
if uid != -1:
130+
if rootdir_stat.st_uid != uid:
131+
raise OSError(
132+
f"The temporary directory {rootdir} is not owned by the current user. "
133+
"Fix this and try again."
134+
)
135+
if (rootdir_stat.st_mode & 0o077) != 0:
136+
os.chmod(rootdir, rootdir_stat.st_mode & ~0o077)
118137
basetemp = make_numbered_dir_with_cleanup(
119138
prefix="pytest-",
120139
root=rootdir,

testing/test_tmpdir.py

+25
Original file line numberDiff line numberDiff line change
@@ -461,3 +461,28 @@ def test_tmp_path_factory_create_directory_with_safe_permissions(
461461
assert (basetemp.stat().st_mode & 0o077) == 0
462462
# Parent too (pytest-of-foo).
463463
assert (basetemp.parent.stat().st_mode & 0o077) == 0
464+
465+
466+
@pytest.mark.skipif(not hasattr(os, "getuid"), reason="checks unix permissions")
467+
def test_tmp_path_factory_fixes_up_world_readable_permissions(
468+
tmp_path: Path, monkeypatch,
469+
) -> None:
470+
"""Verify that if a /tmp/pytest-of-foo directory already exists with
471+
world-readable permissions, it is fixed.
472+
473+
pytest used to mkdir with such permissions, that's why we fix it up.
474+
"""
475+
# Use the test's tmp_path as the system temproot (/tmp).
476+
monkeypatch.setenv("PYTEST_DEBUG_TEMPROOT", str(tmp_path))
477+
tmp_factory = TempPathFactory(None, lambda *args: None, _ispytest=True)
478+
basetemp = tmp_factory.getbasetemp()
479+
480+
# Before - simulate bad perms.
481+
os.chmod(basetemp.parent, 0o777)
482+
assert (basetemp.parent.stat().st_mode & 0o077) != 0
483+
484+
tmp_factory = TempPathFactory(None, lambda *args: None, _ispytest=True)
485+
basetemp = tmp_factory.getbasetemp()
486+
487+
# After - fixed.
488+
assert (basetemp.parent.stat().st_mode & 0o077) == 0

0 commit comments

Comments
 (0)