Make network cache file permissions inherit from cache directory #13070
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
ichard26
suggested changes
Nov 8, 2024
There was a problem hiding this comment.
I'm not that familiar with how the HTTP cache functions, but it's probably worth clearing the executable bit. There are likely easier ways to abuse pip to compromise a multi-user set up, but even if it's simply to mitigate future "this seems unsecure" bug reports, I'd clear the bit.
|
Thanks for the PR by the way! |
|
Both reasonable suggestions. Done 😄 |
bluetech
reviewed
Nov 13, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Resolves #11012.
The Problem
In a multi-user environment, it would be nice to be able to share a single cache. The NamedTemporaryFile class that is used to create the files is hardcoded to use file mode 600 (owner read/write only). This makes it impossible to share a cache with other users as they would need read/write permissions set for group or others.
The Solution
This PR resolves the problem by changing the file permissions after the file has been written to have the same read/write permissions as those from the cache's directory. One exception is that the owner read/write permissions will always be set (just as it was prior to this change).