os.mkdir(mode=0o700) on Windows from an elevated process creates a directory the interactive user cannot access

Start in Modules/posixmodule.c at os_mkdir_impl and run repro_mkdir_0o700.py on Windows using elevated and non-elevated prompts. Trace how the 0o700 security descriptor is built and determine how the interactive user's access should be represented. Done means an elevated 0o700 mkdir remains accessible to that user while preserving the existing non-elevated behavior.

Bug report

Bug description

On Windows, os.mkdir(path, mode=0o700) (and therefore pathlib.Path.mkdir(mode=0o700), os.makedirs(..., mode=0o700), tempfile.mkdtemp()) applies an explicit, protected DACL whose only user‑facing entry is OW (OWNER RIGHTS). When the calling process is elevated, Windows sets the new object's owner to BUILTIN\Administrators, so OW resolves to Administrators — and the interactive user who ran the program is left with no access at all to a directory they just created. Inheritance is disabled (D:P), so nothing from the parent rescues them, and every child created later inherits the same lockout.

• Introduced by the CVE‑2024‑4030 fix (gh-118486), 3.12.4+ / 3.13+.
• The non‑elevated case is fine: owner = the user, so OW grants them full control.
• Real‑world trigger that led here: Scapy creates ~/.config and ~/.cache with mkdir(mode=0o700) per the XDG spec; it is routinely run elevated on Windows (Npcap). Afterwards every application on the machine that uses ~/.config or ~/.cache fails with PermissionError, and the user cannot even read the ACL (icacls → Access is denied) until an elevated takeown + icacls /reset.

flowchart LR
  A["elevated python<br/>Path('~/.config').mkdir(mode=0o700)"] --> B["posixmodule.c: mode == 0o700 →<br/>D:P(A;OICI;FA;;;SY)(A;OICI;FA;;;BA)(A;OICI;FA;;;OW)"]
  B --> C["CreateDirectoryW(path, &sa)"]
  C --> D["owner = BUILTIN\\Administrators<br/>(default owner for elevated tokens)"]
  D --> E["OW → Administrators<br/>user SID: no ACE, inheritance off"]
  E --> F["non-elevated user:<br/>icacls: Access is denied<br/>mkdir child: WinError 5"]

Where

Modules/posixmodule.c os_mkdir_impl @ 3.13:

if (mode == 0700 /* 0o700 */) {
    ULONG sdSize;
    pSecAttr = &secAttr;
    // Set a discretionary ACL (D) that is protected (P) and includes
    // inheritable (OICI) entries that allow (A) full control (FA) to
    // SYSTEM (SY), Administrators (BA), and the owner (OW).
    if (!ConvertStringSecurityDescriptorToSecurityDescriptorW(
        L"D:P(A;OICI;FA;;;SY)(A;OICI;FA;;;BA)(A;OICI;FA;;;OW)",
        ...
}
if (!error) {
    result = CreateDirectoryW(path->wide, pSecAttr);

OW is only equal to "the user who ran this" when the token's default owner is that user. For a UAC‑elevated token the default owner is BUILTIN\Administrators, so the intent of the comment ("the owner") does not hold for exactly the processes most likely to call this on shared user directories.

Reproduction

repro_mkdir_0o700.py:

"""os.mkdir(mode=0o700) on Windows from an elevated process locks out the interactive user.

Usage (Windows, Python >= 3.12.4):
  python repro_mkdir_0o700.py create   # run from an ELEVATED prompt
  python repro_mkdir_0o700.py check    # run from a NON-elevated prompt, same user
"""
import ctypes, os, pathlib, subprocess, sys

base = pathlib.Path(os.environ["USERPROFILE"]) / ".repro-mkdir-0o700"
elevated = bool(ctypes.windll.shell32.IsUserAnAdmin())
print(f"python {sys.version.split()[0]}  user={os.getlogin()}  elevated={elevated}")

if sys.argv[1] == "create":
    base.mkdir(mode=0o700)
    (base / "default-mode").mkdir()
    print(subprocess.run(["icacls", str(base)], capture_output=True, text=True).stdout)
    print(subprocess.run(["icacls", str(base / "default-mode")], capture_output=True, text=True).stdout)

if sys.argv[1] == "check":
    print(subprocess.run(["icacls", str(base)], capture_output=True, text=True).stdout.strip())
    try:
        (base / "child").mkdir(parents=True, exist_ok=True)
        print("mkdir child: ok")
    except OSError as e:
        print(f"mkdir child: {type(e).__name__}: {e}")

Output, Windows 11 Pro 10.0.26200, Python 3.13.7 (embeddable amd64), same user for both steps:

=== create (elevated)
python 3.13.7  user=Lukem  elevated=True
C:\Users\Lukem\.repro-mkdir-0o700 NT AUTHORITY\SYSTEM:(OI)(CI)(F)
                                  BUILTIN\Administrators:(OI)(CI)(F)
                                  OWNER RIGHTS:(OI)(CI)(F)

C:\Users\Lukem\.repro-mkdir-0o700\default-mode NT AUTHORITY\SYSTEM:(I)(OI)(CI)(F)
                                               BUILTIN\Administrators:(I)(OI)(CI)(F)
                                               OWNER RIGHTS:(I)(OI)(CI)(F)

=== check (non-elevated)
python 3.13.7  user=Lukem  elevated=False
Successfully processed 0 files; Failed processing 1 files
mkdir child: PermissionError: [WinError 5] Access is denied: 'C:\\Users\\Lukem\\.repro-mkdir-0o700\\child'

Get-Acl on the directory reports Owner = BUILTIN\Administrators, AreAccessRulesProtected = True. Note default-mode, created with the default mode inside, inherits the lockout.

Expected

The user who ran the program can access the directory afterwards, as they can on POSIX with 0700 and as they can with every other mode value on Windows. Options:

• Add the token's user SID explicitly alongside OW — e.g. resolve TokenUser and append (A;OICI;FA;;;<user SID>) — so 0o700 means "the user, SYSTEM, Administrators" regardless of who the default owner is.
• Or, at minimum, document in os.mkdir / tempfile that under an elevated token 0o700 excludes the interactive user, and that OW means the default owner, not the logged‑in user.

Your environment

• CPython versions tested on: 3.13.7 (python-3.13.7-embed-amd64)
• Operating system and architecture: Windows 11 Pro 10.0.26200, x64, NTFS