tempfile.mkstemp: add mode=0o600 parameter

從 tempfile.mkstemp 和 tempfile._mkstemp_inner 開始，然後查看連結的 Borg 討論和修正，以了解先前的內容。確認目前硬編碼的模式如何套用、模式參數將如何流經兩個進入點，以及預設行為和 umask 行為應如何維持不變。在不變更安全預設值的情況下支援所要求的模式，即表示完成。

Enhancement

Currently the file mode for the temp file is hardcoded to be 0o600. While this might be a good default for real temporary files for security reasons, I propose it should offer flexibility if the use case is slightly different.

It can and should still default to 0o600, but should not be hardcoded.

Besides having "real" temp files that just get thrown away, a popular use case for temp files is also this:

• create a temp file in a specific parent directory (same as parent dir of final file)
• write data to the temp file (e.g. a new configuration file)
• close the file, sync data and metadata to disk
• atomically rename the temp file over the previous version of the file (must be on same fs for this, see step 1)
• sync again

That way, the file has always valid contents (either the old version or the new version) and you never get 0-bytes files or otherwise corrupted files.

The problem with the hardcoded 0o600 mode in such an application is that the file you end up with (and which is not temporary any more, but your final file (e.g. config file)) will also have that 0o600 mode, which is unexpected if your umask usually would create files with e.g. 0o660 mode.

Trying to "fix" the file mode has pitfalls:

• to get the umask, you have to set it (and potentially re-set it again to the returned value), which is awkward
• os.chmod is not supported on all filesystems and might throw an exception. this issue might go unnoticed until someone uses the code with e.g. cifs (samba share).
• even if the chmod works, posix ACLs might still behave in unexpected ways (see link in "previous discussion")

The root cause of this issue is the 0o600 mode. If one uses 0o666, everything behaves as normal, umask works, final mode is correct, ACLs don't get modified. Note that when giving mode=0o666, the umask will still get applied afterwards, so one might well end up with a 0o660 or 0o640 mode on the file.

Pitch

tempfile.mkstemp(..., mode=0o600)
tempfile._mkstemp_inner(..., mode)

So it is as secure as now by default and still usable for the above popular use case without people having to do dirty stuff.

Previous discussion

• 1st issue: https://github.com/borgbackup/borg/issues/6400
• 1st fix: https://github.com/borgbackup/borg/pull/6403
• 2nd issue https://github.com/borgbackup/borg/issues/6786
• 2nd fix: https://github.com/borgbackup/borg/pull/6787
• 3rd issue: https://github.com/borgbackup/borg/issues/6933
• 3rd fix: https://github.com/borgbackup/borg/pull/6936
• to be continued?