Skip to content

Commit 2ce2600

Browse files
authored
gh-151519: Check effective gid in _test_all_chown_common group-0 guard (#151521)
The guard that skips the "chown to gid 0 should fail" assertion used only `os.getgroups()` (supplementary groups). The kernel also accepts the effective/filesystem gid for chown, so when a process runs with egid 0 and a non-zero uid (common in containers and user namespaces), chown(-1, 0) succeeds and the assertion spuriously fails. Add an `os.getegid() != 0` check alongside the existing `0 not in os.getgroups()` guard.
1 parent 0777a58 commit 2ce2600

1 file changed

Lines changed: 3 additions & 1 deletion

File tree

Lib/test/test_os/test_posix.py

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -901,7 +901,9 @@ def check_stat(uid, gid):
901901
self.assertRaises(OSError, chown_func, first_param, 0, -1)
902902
check_stat(uid, gid)
903903
if hasattr(os, 'getgroups'):
904-
if 0 not in os.getgroups():
904+
# Also check the effective gid, which the kernel
905+
# accepts for chown even if not in getgroups().
906+
if 0 not in os.getgroups() and os.getegid() != 0:
905907
self.assertRaises(OSError, chown_func, first_param, -1, 0)
906908
check_stat(uid, gid)
907909
# test illegal types

0 commit comments

Comments
 (0)