Skip to content

Commit 01489b0

Browse files
itamarometa-codesync[bot]
authored andcommitted
test_posix: fix flaky chown-to-gid-0 assertion under gid 0
Summary: `PosixTester._test_all_chown_common` asserts that chowning a file's group to gid 0 raises OSError when the process is "unprivileged". It gated that on `0 not in os.getgroups()`, but group membership for chown also includes the process's effective gid, which getgroups() does not report. In sandboxes / user namespaces that run with gid 0 and a non-zero uid, chgrp-to-0 therefore succeeds and the assertion fails ("OSError not raised by {chown,fchown,lchown}") while the owner-to-0 assertions (which need CAP_CHOWN) still correctly raise. Also require `os.getegid() != 0` before asserting the failure. <!-- pyimport-metadata:begin --> This diff adds a patch to the `third-party/python/3.14` Meta-internal fork. test_posix: chgrp-to-0 membership also includes the effective gid; avoids spurious failure when the sandbox runs with gid 0 Reviewed By: Yhg1s Differential Revision: D108567108 fbshipit-source-id: 25345fc871b9e834af3241a94afed9cf85dcb987
1 parent e0e4251 commit 01489b0

1 file changed

Lines changed: 7 additions & 1 deletion

File tree

Lib/test/test_posix.py

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -838,7 +838,13 @@ def check_stat(uid, gid):
838838
self.assertRaises(OSError, chown_func, first_param, 0, -1)
839839
check_stat(uid, gid)
840840
if hasattr(os, 'getgroups'):
841-
if 0 not in os.getgroups():
841+
# The kernel checks group membership for chown against the
842+
# effective (fs) gid as well as the supplementary groups, so
843+
# guard on getegid() too. In some sandboxes/user namespaces the
844+
# process runs with an effective gid of 0 (and a non-zero uid),
845+
# which makes chowning the group to 0 succeed even though 0 is
846+
# absent from getgroups().
847+
if 0 not in os.getgroups() and os.getegid() != 0:
842848
self.assertRaises(OSError, chown_func, first_param, -1, 0)
843849
check_stat(uid, gid)
844850
# test illegal types

0 commit comments

Comments
 (0)