python / python/cpython

`os.chmod` is missing validation for `dir_fd` and `follow_symlinks` when `path` is a file descriptor

Open
#156,264 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

extension-modules type-feature
Dominant language
Python
Stars
77.2k
Forks
35.9k
PR merge metrics
PR metrics pending

Description

Bug report

Bug description:

The documentation for os.chmod says it is not correct to use dir_fd or follow_symlinks when path is an open file descriptor...

https://github.com/python/cpython/blob/f74cdf80a120649e4c353430da8cbd1305c00993/Modules/posixmodule.c#L4092-L4095

... but os_chmod_impl never checks it.

When path->is_fd is true it takes the fchmod path and returns success, so both keywords are ignored altogether:

https://github.com/python/cpython/blob/f74cdf80a120649e4c353430da8cbd1305c00993/Modules/posixmodule.c#L4146-L4149

Other os utils (I checked os.stat, os.chown, and os.utime) reject this combination with dir_fd_and_fd_invalid / fd_and_follow_symlinks_invalid before the syscall. os.chown for example:

https://github.com/python/cpython/blob/f74cdf80a120649e4c353430da8cbd1305c00993/Modules/posixmodule.c#L4548-L4550

(The Windows path also has the same problem with: path->is_fd going directly to win32_fchmod.)

CPython versions tested on:

CPython main branch

Operating systems tested on:

macOS

Linked PRs
  • gh-156265

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in Modules/posixmodule.c at os_chmod_impl and inspect the path->is_fd branches for POSIX and Windows. Compare their handling with the validation used by os.chown, os.stat, and os.utime. Done means invalid dir_fd and follow_symlinks combinations are rejected when path is a file descriptor, with behavior covered by the relevant os tests.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
operating-systems
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.