Skip to content

Commit c6b26b5

Browse files
itamaromiss-islington
authored andcommitted
gh-151519: Check effective gid in _test_all_chown_common group-0 guard (GH-151521)
The guard that skips the "chown to gid 0 should fail" assertion used only `os.getgroups()` (supplementary groups). The kernel also accepts the effective/filesystem gid for chown, so when a process runs with egid 0 and a non-zero uid (common in containers and user namespaces), chown(-1, 0) succeeds and the assertion spuriously fails. Add an `os.getegid() != 0` check alongside the existing `0 not in os.getgroups()` guard. (cherry picked from commit 2ce2600) Co-authored-by: Itamar Oren <itamarost@gmail.com>
1 parent 10d93ff commit c6b26b5

1 file changed

Lines changed: 3 additions & 1 deletion

File tree

Lib/test/test_posix.py

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -838,7 +838,9 @@ def check_stat(uid, gid):
838838
self.assertRaises(OSError, chown_func, first_param, 0, -1)
839839
check_stat(uid, gid)
840840
if hasattr(os, 'getgroups'):
841-
if 0 not in os.getgroups():
841+
# Also check the effective gid, which the kernel
842+
# accepts for chown even if not in getgroups().
843+
if 0 not in os.getgroups() and os.getegid() != 0:
842844
self.assertRaises(OSError, chown_func, first_param, -1, 0)
843845
check_stat(uid, gid)
844846
# test illegal types

0 commit comments

Comments
 (0)