OpenSSH incompatible with `mkdir(mode=0o700)` on Windows with `OWNER RIGHTS`

Bug report

Bug description:

On Windows, when a directory is created using Python's os.mkdir with mode=0o700, permissions for the OWNER RIGHTS group are attached. Files written to the directory inherit these permissions, unless explicitly disabled. This causes incompatibility with the OpenSSH client when attempting to pass a private key file stored in the created directory because permissions are "too open".

Although this can be avoided by calling os.mkdir with mode=0o400, there's no available workaround when using tempfile.TemporaryDirectory since the mode is hardcoded to 0o700.

To reproduce:

# Create a temporary directory
import tempfile

# Take note of `temp_dir.name`
temp_dir = tempfile.TemporaryDirectory()

# Place a private key file into `temp_dir.name`

In Windows Command Prompt:

> ssh -p port -i C:\Path\To\TempDir\Keyfile destination

Bad permissions. Try removing permissions for user: \\OWNER RIGHTS (S-1-3-4) on file C:\Path\To\TempDir\Keyfile.
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@         WARNING: UNPROTECTED PRIVATE KEY FILE!          @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Permissions for 'C:\Path\To\TempDir\Keyfile' are too open.
It is required that your private key files are NOT accessible by others.
This private key will be ignored.
Load key "C:\Path\To\TempDir\Keyfile": bad permissions
destination: Permission denied (publickey,gssapi-keyex,gssapi-with-mic).

Based on the related CPython issue and PR linked below, I understand switching to OWNER RIGHTS was intentionally done to address a CVE. However, this has created friction between tempfile.TemporaryDirectory and OpenSSH.

Related:

• https://github.com/python/cpython/issues/118486
• https://github.com/python/cpython/pull/118515
• https://github.com/aws/aws-cli/issues/9114

CPython versions tested on:

3.12

Operating systems tested on:

Windows

Beginne mit dem fest codierten 0o700-Modus in Lib/tempfile.py ungefähr bei Zeile 384 und prüfe anschließend das zugehörige Issue 118486 sowie den Pull Request 118515 auf die sicherheitstechnische Begründung. Reproduziere die Wechselwirkung zwischen TemporaryDirectory und privaten OpenSSH-Schlüsseln unter Windows; abgeschlossen ist die Aufgabe, wenn die Inkompatibilität behoben ist, ohne den OWNER RIGHTS-Schutz zu beeinträchtigen.