os.set_inheritable(): fall back to fcntl() if ioctl() fails with EACCES

[MichaBednarski]

BPO	27057
Nosy	@vstinner
Files	set_inheritable-eacces.diff: Patch for treating EACCES same as ENOTTY in set_inheritable() set_inheritable-eacces.diff: Patch for treating EACCES same as ENOTTY in set_inheritable()

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = None
closed_at = <Date 2016-05-19.14:52:45.877>
created_at = <Date 2016-05-19.12:15:56.410>
labels = ['type-bug']
title = 'os.set_inheritable(): fall back to fcntl() if ioctl() fails with EACCES'
updated_at = <Date 2016-05-19.16:16:03.892>
user = 'https://bugs.python.org/MichaBednarski'

bugs.python.org fields:

activity = <Date 2016-05-19.16:16:03.892>
actor = 'vstinner'
assignee = 'none'
closed = True
closed_date = <Date 2016-05-19.14:52:45.877>
closer = 'vstinner'
components = []
creation = <Date 2016-05-19.12:15:56.410>
creator = 'Micha\xc5\x82 Bednarski'
dependencies = []
files = ['42897', '42900']
hgrepos = []
issue_num = 27057
keywords = ['patch']
message_count = 7.0
messages = ['265853', '265854', '265860', '265863', '265864', '265869', '265872']
nosy_count = 3.0
nosy_names = ['vstinner', 'python-dev', 'Micha\xc5\x82 Bednarski']
pr_nums = []
priority = 'normal'
resolution = 'fixed'
stage = None
status = 'closed'
superseder = None
type = 'behavior'
url = 'https://bugs.python.org/issue27057'
versions = ['Python 3.5', 'Python 3.6']

[MichaBednarski]

When SELinux forbids ioctl() it fails with EACCES and whole os.set_inheritable raises exception.

As in https://bugs.python.org/issue22258 code was added to fall back to fcntl when ioctl() fails with ENOTTY I'm adding EACCES value to same condition to fall back to fcntl().

[vstinner]

Hum, I'm surprised that SELinux blocks such safe function. Maybe the SELinux policy should be completed to allow it?

Detect when ioctl() fails with EACCESS and fallback to fnctl() sounds like a good option. But do you expect ioctl() to always fail with EACCESS? Or only fail sometimes, or only on some file descriptors? Your patch remembers that ioctl() fails once and never retries.

About your patch: please add a comment explaining why you fallback with a reference to this issue ("Issue bpo-27057").

[MichaBednarski]

Hum, I'm surprised that SELinux blocks such safe function. Maybe the SELinux policy should be completed to allow it?
The ioctl is blocked for given file type regardless of request argument. As I'm running Python on non-rooted Android updating policy is not really an option.

But do you expect ioctl() to always fail with EACCESS? Or only fail sometimes, or only on some file descriptors? Your patch remembers that ioctl() fails once and never retries.
It will always fail for given file type (such as sockets), while it will work for others (such as regular files). I think that remembering that ioctl doesn't work may be okay, though I may be wrong. Either way if we are wrong whenever ioctl works we'll do one extra syscall.

About your patch: please add a comment explaining why you fallback with a reference to this issue ("Issue bpo-27057").
Attached

[python-dev]

New changeset 13c5135d8467 by Victor Stinner in branch '3.5':
Fix os.set_inheritable() on Android
https://hg.python.org/cpython/rev/13c5135d8467

New changeset 783c1b8cdddb by Victor Stinner in branch 'default':
Merge 3.5 (issue bpo-27057)
https://hg.python.org/cpython/rev/783c1b8cdddb

[vstinner]

The ioctl is blocked for given file type regardless of request argument. As I'm running Python on non-rooted Android updating policy is not really an option.

Oh. Right :-) My intent was to suggest to report the SELinux issue upstream ;-)

It will always fail for given file type (such as sockets), while it will work for others (such as regular files). I think that remembering that ioctl doesn't work may be okay, though I may be wrong. Either way if we are wrong whenever ioctl works we'll do one extra syscall.

The purpose of using ioctl() is to *reduce* the number of syscalls. If an application mostly use sockets, it will do 3 syscalls per socket (ioctl, fcntl get, fcntl set) instead of just 2 (fcntl get, fcntl set) :-/ So I like your patch ;-)

I applied your fix to Python 3.5 and 3.6. Thanks for your contribution.

You should now sign the PSF Contributor Agreement:
https://www.python.org/psf/contrib/contrib-form/

(Well, in fact it would be better to do that *before* merging your change, but well, your change is short enough ;-))

[MichaBednarski]

You should now sign the PSF Contributor Agreement
Done.

(Well, in fact it would be better to do that *before* merging your change, but well, your change is short enough ;-))
Well on https://docs.python.org/devguide/patch.html was said "For non-trivial changes".

[vstinner]

> You should now sign the PSF Contributor Agreement
Done.

Thanks!