Skip to content

Commit c49100c

Browse files
committed
tmpdir: prevent using a non-private root temp directory
pytest uses a root temp directory named `/tmp/pytest-of-<username>`. The name is predictable, and the directory might already exists from a previous run, so that's allowed. This makes it possible for my_user to pre-create `/tmp/pytest-of-another_user`, thus giving my_user control of another_user's tempdir. Prevent this scenario by adding a couple of safety checks. I believe they are sufficient. Testing the first check requires changing the owner, which requires root permissions, so can't be unit-tested easily, but I checked it manually.
1 parent 1278f8b commit c49100c

File tree

3 files changed

+49
-0
lines changed

3 files changed

+49
-0
lines changed

changelog/8414.bugfix.rst

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,3 +3,8 @@ permissions. This means that any user in the system was able to read
33
information written by tests in temporary directories (such as those created by
44
the ``tmp_path``/``tmpdir`` fixture). Now the directories are created with
55
private permissions.
6+
7+
pytest used silenty use a pre-existing ``/tmp/pytest-of-<username>`` directory,
8+
even if owned by another user. This means another user could pre-create such a
9+
directory and gain control of another user's temporary directory. Now such a
10+
condition results in an error.

src/_pytest/tmpdir.py

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -124,6 +124,25 @@ def getbasetemp(self) -> Path:
124124
# getuser() likely returned illegal characters for the platform, use unknown back off mechanism
125125
rootdir = temproot.joinpath("pytest-of-unknown")
126126
rootdir.mkdir(mode=0o700, exist_ok=True)
127+
# Because we use exist_ok=True with a predictable name, make sure
128+
# we are the owners, to prevent any funny business (on unix, where
129+
# temproot is usually shared).
130+
# Also, to keep things private, fixup any world-readable temp
131+
# rootdir's permissions. Historically 0o755 was used, so we can't
132+
# just error out on this, at least for a while.
133+
if hasattr(os, "getuid"):
134+
rootdir_stat = rootdir.stat()
135+
uid = os.getuid()
136+
# getuid shouldn't fail, but cpython defines such a case.
137+
# Let's hope for the best.
138+
if uid != -1:
139+
if rootdir_stat.st_uid != uid:
140+
raise OSError(
141+
f"The temporary directory {rootdir} is not owned by the current user. "
142+
"Fix this and try again."
143+
)
144+
if (rootdir_stat.st_mode & 0o077) != 0:
145+
os.chmod(rootdir, rootdir_stat.st_mode & ~0o077)
127146
basetemp = make_numbered_dir_with_cleanup(
128147
prefix="pytest-",
129148
root=rootdir,

testing/test_tmpdir.py

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -470,3 +470,28 @@ def test_tmp_path_factory_create_directory_with_safe_permissions(
470470
assert (basetemp.stat().st_mode & 0o077) == 0
471471
# Parent too (pytest-of-foo).
472472
assert (basetemp.parent.stat().st_mode & 0o077) == 0
473+
474+
475+
@pytest.mark.skipif(not hasattr(os, "getuid"), reason="checks unix permissions")
476+
def test_tmp_path_factory_fixes_up_world_readable_permissions(
477+
tmp_path: Path, monkeypatch: MonkeyPatch
478+
) -> None:
479+
"""Verify that if a /tmp/pytest-of-foo directory already exists with
480+
world-readable permissions, it is fixed.
481+
482+
pytest used to mkdir with such permissions, that's why we fix it up.
483+
"""
484+
# Use the test's tmp_path as the system temproot (/tmp).
485+
monkeypatch.setenv("PYTEST_DEBUG_TEMPROOT", str(tmp_path))
486+
tmp_factory = TempPathFactory(None, lambda *args: None, _ispytest=True)
487+
basetemp = tmp_factory.getbasetemp()
488+
489+
# Before - simulate bad perms.
490+
os.chmod(basetemp.parent, 0o777)
491+
assert (basetemp.parent.stat().st_mode & 0o077) != 0
492+
493+
tmp_factory = TempPathFactory(None, lambda *args: None, _ispytest=True)
494+
basetemp = tmp_factory.getbasetemp()
495+
496+
# After - fixed.
497+
assert (basetemp.parent.stat().st_mode & 0o077) == 0

0 commit comments

Comments
 (0)