Skip to content

Commit 7224afe

Browse files
itamaromiss-islington
authored andcommitted
gh-151519: Check effective gid in _test_all_chown_common group-0 guard (GH-151521)
The guard that skips the "chown to gid 0 should fail" assertion used only `os.getgroups()` (supplementary groups). The kernel also accepts the effective/filesystem gid for chown, so when a process runs with egid 0 and a non-zero uid (common in containers and user namespaces), chown(-1, 0) succeeds and the assertion spuriously fails. Add an `os.getegid() != 0` check alongside the existing `0 not in os.getgroups()` guard. (cherry picked from commit 2ce2600) Co-authored-by: Itamar Oren <itamarost@gmail.com>
1 parent ab61101 commit 7224afe

1 file changed

Lines changed: 3 additions & 1 deletion

File tree

Lib/test/test_os/test_posix.py

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -899,7 +899,9 @@ def check_stat(uid, gid):
899899
self.assertRaises(OSError, chown_func, first_param, 0, -1)
900900
check_stat(uid, gid)
901901
if hasattr(os, 'getgroups'):
902-
if 0 not in os.getgroups():
902+
# Also check the effective gid, which the kernel
903+
# accepts for chown even if not in getgroups().
904+
if 0 not in os.getgroups() and os.getegid() != 0:
903905
self.assertRaises(OSError, chown_func, first_param, -1, 0)
904906
check_stat(uid, gid)
905907
# test illegal types

0 commit comments

Comments
 (0)