Use Linux O_TMPFILE flag in tempfile.TemporaryFile?

[vstinner]

BPO	21515
Nosy	@birkenfeld, @ncoghlan, @pitrou, @vstinner, @socketpair, @serhiy-storchaka, @MojoVampire
Files	tempfile_o_tmpfile.patch tempfile_o_tmpfile3.patch tempfile_comment.patch

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = None
closed_at = <Date 2015-10-20.22:20:25.342>
created_at = <Date 2014-05-16.09:17:21.221>
labels = []
title = 'Use Linux O_TMPFILE flag in tempfile.TemporaryFile?'
updated_at = <Date 2021-09-12.23:29:16.133>
user = 'https://github.com/vstinner'

bugs.python.org fields:

activity = <Date 2021-09-12.23:29:16.133>
actor = 'WGH'
assignee = 'none'
closed = True
closed_date = <Date 2015-10-20.22:20:25.342>
closer = 'vstinner'
components = []
creation = <Date 2014-05-16.09:17:21.221>
creator = 'vstinner'
dependencies = []
files = ['35261', '35277', '40824']
hgrepos = []
issue_num = 21515
keywords = ['patch']
message_count = 28.0
messages = ['218648', '218649', '218650', '218653', '218660', '218661', '218667', '218670', '218671', '218690', '218738', '218739', '219792', '219803', '219807', '219808', '220037', '220059', '253196', '253213', '253238', '253240', '253245', '253247', '253248', '253265', '253266', '401675']
nosy_count = 11.0
nosy_names = ['georg.brandl', 'ncoghlan', 'pitrou', 'vstinner', 'Arfrever', 'neologix', 'socketpair', 'python-dev', 'serhiy.storchaka', 'josh.r', 'WGH']
pr_nums = []
priority = 'normal'
resolution = 'fixed'
stage = None
status = 'closed'
superseder = None
type = None
url = 'https://bugs.python.org/issue21515'
versions = ['Python 3.5']

[vstinner]

Linux 3.11 introduced a new file flag "O_TMPFILE". The flag is exposed in Python, see the issue bpo-18673.

"O_TMPFILE is a new open(2)/openat(2) flag that makes easier the creation of secure temporary files. Files opened with the O_TMPFILE flag are created but they are not visible in the filesystem. And as soon as they are closed, they get deleted - just as a file you would have opened and unlinked."
http://kernelnewbies.org/Linux_3.11#head-8be09d59438b31c2a724547838f234cb33c40357

Does it make sense to use this flag in tempfile.TemporaryFile?

Attached patch is a work-in-progress patch for tempfile.

if hasattr(_os, 'O_TMPFILE'):
_O_TMPFILE = _os.O_TMPFILE
elif _sys.platform == 'linux':
__O_TMPFILE = 0o20000000
_O_TMPFILE = (__O_TMPFILE | _os.O_DIRECTORY)

The second if should be removed. I used it because my Linux kernel (3.14) supports the flag, but the constant is not defined yet in C headers of my C library (glibc 2.18).

flags = (flags | _O_TMPFILE) & ~_os.O_CREAT

O_CREAT is incompatible with O_TMPFILE.

Bonus point of the flag: no need to compute a random name! Just pass the temporary directory.

To do: test the patch on Linux < 3.11 to see how the flag is interpreted. If the flag is ignored, we open the directory in write mode! That's insafe. If the flag raises an error, we should fallback to the current implementation and remember that the flag is not supported.

I implemented something similar for O_CLOEXEC and SOCK_CLOEXEC flags (PEP-433).

[pitrou]

I don't think we can use this by default, or it will break the expected semantics of temporary files under Unix (visible by other processes).

[vstinner]

"I don't think we can use this by default, or it will break the expected semantics of temporary files under Unix (visible by other processes)."

I proposed to change TemporaryFile, not NamedTemporaryFile. Do you mean that other processes are supposed to have access to the temporary file descriptor? Access through /proc/pid/fd/<tmp_fd>?

O_TMPFILE should increase the security because there is no more race condition between os.open() and os.unlink() (window where an attack can access the file).

My patch uses O_EXCL. It makes possible to use linkat() to create a path for the temporary file (I didn't try it, but I read that it's possible). I don't know if using O_EXCL should be the default.

[pitrou]

I proposed to change TemporaryFile, not NamedTemporaryFile.

Ah, sorry. Then it sounds ok.
(I couldn't find any documentation for O_TMPFILE, though)

[vstinner]

It looks like O_TMPFILE is supported by tmpfs (3.11), ext3 (3.11), ext4 (3.11), XFS (3.15). It looks like BTRFS will also support the O_TMPFILE:
https://btrfs.wiki.kernel.org/index.php/Project_ideas#Implement_O_TMPFILE_support

--

It looks like os.open() fails with OSError(95, 'Operation not supported') if the filesystem of the directory doesn't support TMPFILE. In this case, a fallback to the current implementation should be enough. I don't think that we need to remember that the directory doesn't support TMPFILE. The directory may be on a different filesystem at the next call.

haypo@smithers$ ~/prog/python/default/python 
Python 3.5.0a0 (default:5e98a50e0f55, May 16 2014, 10:44:10) 
>>> import tempfile
>>> tempfile._O_TMPFILE
4259840
>>> f=tempfile.TemporaryFile(dir='.')
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/home/haypo/prog/python/default/Lib/tempfile.py", line 507, in TemporaryFile
    fd = _os.open(dir, flags, 0o600)
OSError: [Errno 95] Operation not supported: '.'

haypo@smithers$ df .
Sys. de fichiers Taille Utilisé Dispo Uti% Monté sur
192.168.0.42:/test 96G 9,1G 83G 10% /home/haypo/nfs

[vstinner]

It looks like open() ignores O_TMPFILE (0o20000000) on old Linux kernels. Test on Linux 3.2:

>>> fd=os.open("/tmp", os.O_RDWR | O_TMPFILE, 0o600)
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
OSError: [Errno 21] Is a directory: '/tmp'

>>> fd=os.open("/tmp", os.O_RDWR | os.O_DIRECTORY, 0o600)
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
OSError: [Errno 21] Is a directory: '/tmp'

So we should catch OSError(21, "Is a directory: '/tmp'") and fallback to the current implementation (random name, unlink), and remember that the kernel version is too old.

[pitrou]

So we should catch OSError(21, "Is a directory: '/tmp'") and fallback
to the current implementation (random name, unlink), and remember that
the kernel version is too old.

Just catch any OSError?

[vstinner]

Just catch any OSError?

If possible, I would prefer to not retry O_TMPFILE each time if the kernel version does not support the flag.

Pseudo-code:

if o_tmpfile_supported:
try:
fd = os.open(dir, os.O_TMPFILE | ...)
except IsADirectoryError:
# Linux kernel older than 3.11 ignores O_TMPFILE flag
o_tmpfile_supported = False
except OSError:
# the filesystem doesn't support O_TMPFILE
pass
else:
return io.open(fd, ...)
# fallback to unsafe but portable implementation

# current code generating a name and using unlink
---

[pitrou]

> Just catch any OSError?

If possible, I would prefer to not retry O_TMPFILE each time if the kernel version does not support the flag.

How likely it is to have a glibc flag that's not supported by the kernel
(on a normal setup, not a self-compiled distro)?

[ncoghlan]

Reasonably common, I believe. For example, Red Hat ships a Developer
Toolset, so you may be building with an up to date gcc on RHEL 6 or 7, but
still support deploying against the older kernel in RHEL 5.

[vstinner]

tempfile_o_tmpfile2.patch: Updated patch to handle OS errors.

I'm not sure that __O_TMPFILE has the same value on all architectures.

The O_TMPFILE flag was added to fcntl.h in the glibc 2.19 (released the 8 Feb 2014):
https://sourceware.org/git/?p=glibc.git;a=commit;h=ffdd31816a67f48697ea4d6b852e58d2886d42ca

My Linux Fedora 20 uses the glibc 2.18.

I removed the hardcoded constant from my patch. Add this to Lib/tempfile.py to test manually if you have a glibc older than 2.19:

# after "if hasattr(_os, 'O_TMPFILE'):"
elif _sys.platform == 'linux':
__O_TMPFILE = 0o20000000
_O_TMPFILE = (__O_TMPFILE | _os.O_DIRECTORY)

[vstinner]

(Oops, I made a mistake, the hardcoded constant was still present in my patch 2.)

Patch 3 uses tempfile._O_TMPFILE_WORKS variable to check if the O_TMPFILE flag is avaialble and works.

Use "os.O_TMPFILE = 0o20000000 | os.O_DIRECTORY" to try my patch with glibc older than 2.19.

[vstinner]

Can someone please review tempfile_o_tmpfile3.patch ?

[pitrou]

It would be nice if the patch added a pointer to the O_TMPFILE documentation (if that exists) and mentioned that it is Linux-specific.
Otherwise, it looks good to me.

[python-dev]

New changeset 4b51a992cb70 by Victor Stinner in branch 'default':
Issue bpo-21515: tempfile.TemporaryFile now uses os.O_TMPFILE flag is available
http://hg.python.org/cpython/rev/4b51a992cb70