Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

access to mkfifo, mknod and hard links is controled by SELinux MAC on Android #72945

Closed
xdegaye mannequin opened this issue Nov 21, 2016 · 13 comments
Closed

access to mkfifo, mknod and hard links is controled by SELinux MAC on Android #72945

xdegaye mannequin opened this issue Nov 21, 2016 · 13 comments
Labels
3.7 (EOL) end of life tests Tests in the Lib/test dir type-bug An unexpected behavior, bug, or error

Comments

@xdegaye
Copy link
Mannequin

xdegaye mannequin commented Nov 21, 2016

BPO 28759
Nosy @xdegaye, @serhiy-storchaka
PRs
  • bpo-28759: Skip some tests on PermissionError raised by Android #4350
  • [3.6] bpo-28759: Skip some tests on PermissionError raised by Android… #4380
  • Files
  • android_not_root.patch
  • without_android_not_root.patch
  • issue28759-01.patch
  • Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.

    Show more details

    GitHub fields:

    assignee = None
    closed_at = <Date 2017-11-12.17:20:18.378>
    created_at = <Date 2016-11-21.08:12:54.980>
    labels = ['3.7', 'type-bug', 'tests']
    title = 'access to mkfifo, mknod and hard links is controled by SELinux MAC on Android'
    updated_at = <Date 2017-11-12.17:20:18.377>
    user = 'https://github.com/xdegaye'

    bugs.python.org fields:

    activity = <Date 2017-11-12.17:20:18.377>
    actor = 'xdegaye'
    assignee = 'none'
    closed = True
    closed_date = <Date 2017-11-12.17:20:18.378>
    closer = 'xdegaye'
    components = ['Tests']
    creation = <Date 2016-11-21.08:12:54.980>
    creator = 'xdegaye'
    dependencies = []
    files = ['45577', '46218', '46231']
    hgrepos = []
    issue_num = 28759
    keywords = ['patch']
    message_count = 13.0
    messages = ['281329', '283088', '285005', '285008', '285040', '285041', '285064', '285246', '285303', '285309', '285312', '306119', '306127']
    nosy_count = 3.0
    nosy_names = ['xdegaye', 'python-dev', 'serhiy.storchaka']
    pr_nums = ['4350', '4380']
    priority = 'normal'
    resolution = 'fixed'
    stage = 'resolved'
    status = 'closed'
    superseder = None
    type = 'behavior'
    url = 'https://bugs.python.org/issue28759'
    versions = ['Python 3.6', 'Python 3.7']

    @xdegaye
    Copy link
    Mannequin Author

    xdegaye mannequin commented Nov 21, 2016

    List of the tests that fail with PermissionError when run as a non-root user on an Android emulator (API 24) and fixed by this patch:
    test_posix test_shutil test_stat test_genericpath test_ntpath test_posixpath test_macpath test_eintr test_pathlib
    Android uses SELinux mandatory access control (MAC), see:
    https://source.android.com/security/selinux/
    Android commit message that does not grant hard link capabilities by default:
    https://android.googlesource.com/platform/external/sepolicy/+/85ce2c7

    @xdegaye xdegaye mannequin self-assigned this Nov 21, 2016
    @xdegaye xdegaye mannequin added 3.7 (EOL) end of life tests Tests in the Lib/test dir type-bug An unexpected behavior, bug, or error labels Nov 21, 2016
    @python-dev
    Copy link
    Mannequin

    python-dev mannequin commented Dec 13, 2016

    New changeset 43f9366d8883 by Xavier de Gaye in branch '3.6':
    Issue bpo-28759: Fix the tests that fail with PermissionError when run as
    https://hg.python.org/cpython/rev/43f9366d8883

    New changeset db1d20825d71 by Xavier de Gaye in branch 'default':
    Issue bpo-28759: Merge 3.6.
    https://hg.python.org/cpython/rev/db1d20825d71

    @xdegaye xdegaye mannequin closed this as completed Dec 13, 2016
    @xdegaye
    Copy link
    Mannequin Author

    xdegaye mannequin commented Jan 8, 2017

    Re-opening the issue for a more generic change that skips the tests when PermissionError is raised instead of when they are run by an Android non-root user as this is done currently after the previously pushed changes.

    @xdegaye xdegaye mannequin reopened this Jan 8, 2017
    @serhiy-storchaka
    Copy link
    Member

    I think it is worth to add special helper in test.support for using as a context manager:

        with helper():
            os.mkfifo(filename)

    Then you could change its implementation without changing the testing code. For example:

        @contextmanager
        def helper():
            try:
                yield
            except PermissionError as e:
                raise unittest.SkipTest(str(e))

    or

        @contextmanager
        def helper():
            if android_not_root:
                raise unittest.SkipTest("operation not allowed, non root user")
            yield

    @xdegaye
    Copy link
    Mannequin Author

    xdegaye mannequin commented Jan 9, 2017

    Thanks for this interesting suggestion Serhiy. I propose to use supported_operation() as the name of the helper() generator.

    I will update the patches accordingly in issues bpo-29180, bpo-29181 and bpo-29184, and re-open bpo-28764.

    @xdegaye
    Copy link
    Mannequin Author

    xdegaye mannequin commented Jan 9, 2017

    re-open bpo-28764.

    Oops, no bpo-28764 is not relevant here.

    @xdegaye
    Copy link
    Mannequin Author

    xdegaye mannequin commented Jan 9, 2017

    New patch following Serhiy's suggestion in msg285008.

    @serhiy-storchaka
    Copy link
    Member

    I don't know what is a good name for such helper. supported_operation() looks too general. Maybe ask on Python-Dev?

    @xdegaye
    Copy link
    Mannequin Author

    xdegaye mannequin commented Jan 12, 2017

    'supported_operation':

    • The intent in using 'supported' was that the context manager could possibly be extended later.
    • 'operation' is the terminology used in the GNU libc documentation [1].
      I will replace 'supported_operation' with 'permitted_operation' unless a better name is proposed.

    [1] https://www.gnu.org/software/libc/manual/html_node/Error-Codes.html

    @serhiy-storchaka
    Copy link
    Member

    The purpose of this helper is skipping the test rather than failing if some OS operation is not permitted by current configuration. May be skip_if_not_permitted()?

    Similar helpers that convert runtime error in skipping a test: import_module(), get_attribute(), bind_unix_socket(), system_must_validate_cert(). They are more concrete, guard some specific operation.

    Context manager is not the only possible syntax. The helper can call a function:

        helper(os.mkfifo, filename)

    or be a wrapper:

    helper(os.mkfifo)(filename)
    

    If you prefer such syntax.

    There are many possibilities, and I think it is worth to discuss this on Python-Dev.

    @xdegaye
    Copy link
    Mannequin Author

    xdegaye mannequin commented Jan 12, 2017

    Please go ahead and start the discussion on Python-Dev.

    @xdegaye xdegaye mannequin removed their assignment Jan 12, 2017
    @xdegaye
    Copy link
    Mannequin Author

    xdegaye mannequin commented Nov 12, 2017

    New changeset 92c2ca7 by xdegaye in branch 'master':
    bpo-28759: Skip some tests on PermissionError raised by Android (GH-4350)
    92c2ca7

    @xdegaye
    Copy link
    Mannequin Author

    xdegaye mannequin commented Nov 12, 2017

    New changeset ad004f9 by xdegaye in branch '3.6':
    [3.6] bpo-28759: Skip some tests on PermissionError raised by Android (GH-4350) (bpo-4380)
    ad004f9

    @xdegaye xdegaye mannequin closed this as completed Nov 12, 2017
    @ezio-melotti ezio-melotti transferred this issue from another repository Apr 10, 2022
    Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
    Labels
    3.7 (EOL) end of life tests Tests in the Lib/test dir type-bug An unexpected behavior, bug, or error
    Projects
    None yet
    Development

    No branches or pull requests

    1 participant