bpo-38893: Ignore EACCES, ENOSYS in copyxattr by tiran · Pull Request #21430 · python/cpython

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open

tiran wants to merge 1 commit into python:main

base: main
Choose a base branch

from tiran:bpo-38893-xattr

Conversation

tiran

Copy link

Member

@tiran tiran commented Jul 10, 2020

:func:shutil.copystat now ignores :const:errno.ENOSYS and
:const:errno.EACCES when copying extended file attributes.
:func:os.listxattr can fail with ENOSYS on some file systems (e.g. NFS).
An LSM may block :func:os.setxattr for security attributes like
security.selinux.

Signed-off-by: Christian Heimes christian@python.org

https://bugs.python.org/issue38893

:func:`shutil.copystat` now ignores :const:`errno.ENOSYS` and
:const:`errno.EACCES` when copying extended file attributes.
:func:`os.listxattr` can fail with ENOSYS on some file systems (e.g. NFS).
An LSM may block :func:`os.setxattr` for security attributes like
``security.selinux``.

Signed-off-by: Christian Heimes <christian@python.org>

@tiran

Copy link

Member Author

tiran commented Jul 10, 2020

@adelton

I am not sure I'm fond of silently ignoring errors -- that can have security implications since the result might not be as expected.
I'd rather see an approach where the operation (copying specific extended attributes) is not attempted at all in situations or environments where it is not supported or not expected to work. That way after copystat that passed you'd know that things are in expected shape. If you ignore the errors, in case of SELinux labels you will likely still get AVC denials on the host, so the result will be even more confusing.

@Tubbles

@ambv

Copy link

Contributor

ambv commented May 17, 2022

This missed the boat for inclusion in Python 3.9 which accepts security fixes only as of today.