shutil.copy2 race condition leading to local file disclosure

Bug report

shutil.copy2 first copies the contents (creating the file with default permissions), then sets the permissions. This allows a local attacker that can read the directory to quickly grab the contents of the file before the permissions are changed. (This was reported to security@ on 2022-02-04 and has now been publicly disclosed - the link has some extra detail. Creating the bug here as directed.)

Source code: https://github.com/python/cpython/blob/3.10/Lib/shutil.py#L434

Note that changing the permissions after file creation but before writing content is insufficient: if the file is created with permissions that allow the attacker to open it, the attacker can get a file handle for the (empty) file. Under POSIX, the handle remains valid and readable even if the permissions change, allowing the attacker to read the file contents when they're populated. (@tiran, please feel free to add the info from your security@ response.)

I've confirmed that this is reliably exploitable (if the file is being created in a directory that the attacker can read), proof of concept code is available in https://github.com/janschejbal/raceread/. This is relevant in practice due to questionable choices by some distributions, causing many home directories to be created with permissions 755, i.e. world-readable (Ubuntu only changed that in 21.04).

Your environment

I've tested this on Python 3.8.10 on Ubuntu 20.04.3 LTS, but I believe it to affect all versions on any POSIX-compliant platform.

Trước tiên, hãy xem xét Lib/shutil.py quanh dòng 434 và proof of concept raceread được liên kết, tập trung vào thứ tự sao chép và xử lý quyền trên POSIX. Được xem là hoàn tất khi việc tiết lộ tệp cục bộ đã được báo cáo không còn tái hiện trong các trường hợp POSIX bị ảnh hưởng và hành vi đã được xác minh theo kịch bản của issue.