classification
Title: test_UNC_path failure in test_import
Type: behavior Stage: resolved
Components: Library (Lib), Tests, Windows Versions: Python 3.2, Python 3.3, Python 2.7
process
Status: closed Resolution: fixed
Dependencies: Superseder:
Assigned To: Nosy List: brian.curtin, jeremy.kloth, jkloth, pitrou, python-dev, tim.golden
Priority: normal Keywords:

Created on 2012-07-12 20:42 by pitrou, last changed 2012-07-13 22:33 by pitrou. This issue is now closed.

Messages (12)
msg165333 - (view) Author: Antoine Pitrou (pitrou) * (Python committer) Date: 2012-07-12 20:42
On the Win64 buildbot, trying to access an UNC path raises PermissionError, which makes a test fail:

======================================================================
ERROR: test_UNC_path (test.test_import.PathsTests)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "D:\buildbot.python.org\3.x.kloth-win64\build\lib\test\test_import.py", line 469, in test_UNC_path
    os.listdir(unc)
PermissionError: [Error 5] Access is denied: '\\\\hades\\D$\\buildbot.python.org\\3.x.kloth-win64\\build\\build\\test_python_3612\\@test_3612_tmp\\*.*'


If this is expected or normal, maybe we should simply skip the test when the listdir() call above fails.
msg165334 - (view) Author: Antoine Pitrou (pitrou) * (Python committer) Date: 2012-07-12 20:43
Example URL for the aforementioned failure:

http://buildbot.python.org/all/builders/AMD64%20Windows7%20SP1%203.x/builds/282/steps/test/logs/stdio
msg165374 - (view) Author: Tim Golden (tim.golden) * (Python committer) Date: 2012-07-13 12:29
Well os.listdir doesn't fail to access a UNC path on Windows x64 in
general. So presumably this particular path is not accessible by the
buildbot process owner?
msg165376 - (view) Author: Antoine Pitrou (pitrou) * (Python committer) Date: 2012-07-13 12:36
Well, this particular path is the build directory itself, so it's certainly accessible through the normal (non-UNC) path. There has to be something else :-) 

Jeremy told me his buildbot process runs as a service, perhaps that is related?
msg165377 - (view) Author: Tim Golden (tim.golden) * (Python committer) Date: 2012-07-13 12:39
It's using an administrative share (\\server\d$) and those are usually
restricted with share permissions -- different from NTFS permissions.
That the process runs as a service is likely to have an effect since
services are conventionally run with minimum-privilege accounts.
msg165379 - (view) Author: Antoine Pitrou (pitrou) * (Python committer) Date: 2012-07-13 12:46
> It's using an administrative share (\\server\d$) and those are usually
> restricted with share permissions -- different from NTFS permissions.
> That the process runs as a service is likely to have an effect since
> services are conventionally run with minimum-privilege accounts.

Ok, so I guess skipping the test in this case would be appropriate?
msg165380 - (view) Author: Tim Golden (tim.golden) * (Python committer) Date: 2012-07-13 13:08
For this particular buildbot setup, maybe yes. But it would be possible
in principle to have a buildbot configuration which could allow the test
to execute. (eg one running under a user account which can access the
path via an admin share). Does the buildbot owner have anything to say
on the account and share permissions?
msg165383 - (view) Author: Jeremy Kloth (jeremy.kloth) Date: 2012-07-13 14:00
The buildbot service account is a standard user (per the buildbot
servce installation directions).  When logged on, the user can access
the share.  Just when logged on as a service is when it cannot.

After much searching, I still cannot find any information on how to
get that user to access to those shares.
msg165388 - (view) Author: Tim Golden (tim.golden) * (Python committer) Date: 2012-07-13 15:22
My guess is that it's to do with Service Hardening. I did a quick dump
of my token in an interactive session and as the owner of a service.
Quite a few differences. I haven't read up on this area yet so I'm not
sure what options there are / how easy to get the necessary privs.
msg165390 - (view) Author: Tim Golden (tim.golden) * (Python committer) Date: 2012-07-13 15:32
Simplest solution might be to catch PermissionError and call skipTest from within. This would allow buildbots to run the test which had access through the relevant share.
msg165402 - (view) Author: Roundup Robot (python-dev) (Python triager) Date: 2012-07-13 19:01
New changeset 4d480a2a6296 by Antoine Pitrou in branch '3.2':
Issue #15338: skip test_UNC_path when the current user doesn't have enough permissions to access the path.
http://hg.python.org/cpython/rev/4d480a2a6296

New changeset 7d5e84a44b82 by Antoine Pitrou in branch 'default':
Issue #15338: skip test_UNC_path when the current user doesn't have enough permissions to access the path.
http://hg.python.org/cpython/rev/7d5e84a44b82
msg165403 - (view) Author: Roundup Robot (python-dev) (Python triager) Date: 2012-07-13 19:08
New changeset 7eac87fa7a06 by Antoine Pitrou in branch '2.7':
Issue #15338: skip test_UNC_path when the current user doesn't have enough permissions to access the path.
http://hg.python.org/cpython/rev/7eac87fa7a06
History
Date User Action Args
2012-07-13 22:33:04pitrousetstatus: open -> closed
resolution: fixed
stage: resolved
2012-07-13 19:08:01python-devsetmessages: + msg165403
2012-07-13 19:01:22python-devsetnosy: + python-dev
messages: + msg165402
2012-07-13 15:32:14tim.goldensetmessages: + msg165390
2012-07-13 15:22:39tim.goldensetmessages: + msg165388
2012-07-13 14:00:01jeremy.klothsetmessages: + msg165383
2012-07-13 13:11:11pitrousetnosy: + jkloth
2012-07-13 13:08:33tim.goldensetmessages: + msg165380
2012-07-13 12:46:01pitrousetmessages: + msg165379
2012-07-13 12:40:00tim.goldensetmessages: + msg165377
2012-07-13 12:36:52pitrousetmessages: + msg165376
2012-07-13 12:29:37tim.goldensetmessages: + msg165374
2012-07-12 20:43:20pitrousetmessages: + msg165334
2012-07-12 20:42:41pitroucreate