test_UNC_path failure in test_import

[pitrou]

BPO	15338
Nosy	@pitrou, @tjguk, @jkloth, @briancurtin

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = None
closed_at = <Date 2012-07-13.22:33:04.931>
created_at = <Date 2012-07-12.20:42:41.183>
labels = ['tests', 'type-bug', 'library', 'OS-windows']
title = 'test_UNC_path failure in test_import'
updated_at = <Date 2012-07-13.22:33:04.930>
user = 'https://github.com/pitrou'

bugs.python.org fields:

activity = <Date 2012-07-13.22:33:04.930>
actor = 'pitrou'
assignee = 'none'
closed = True
closed_date = <Date 2012-07-13.22:33:04.931>
closer = 'pitrou'
components = ['Library (Lib)', 'Tests', 'Windows']
creation = <Date 2012-07-12.20:42:41.183>
creator = 'pitrou'
dependencies = []
files = []
hgrepos = []
issue_num = 15338
keywords = []
message_count = 12.0
messages = ['165333', '165334', '165374', '165376', '165377', '165379', '165380', '165383', '165388', '165390', '165402', '165403']
nosy_count = 6.0
nosy_names = ['pitrou', 'tim.golden', 'jkloth', 'brian.curtin', 'jeremy.kloth', 'python-dev']
pr_nums = []
priority = 'normal'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'behavior'
url = 'https://bugs.python.org/issue15338'
versions = ['Python 2.7', 'Python 3.2', 'Python 3.3']

[pitrou]

On the Win64 buildbot, trying to access an UNC path raises PermissionError, which makes a test fail:

======================================================================
ERROR: test_UNC_path (test.test_import.PathsTests)
----------------------------------------------------------------------

Traceback (most recent call last):
  File "D:\buildbot.python.org\3.x.kloth-win64\build\lib\test\test_import.py", line 469, in test_UNC_path
    os.listdir(unc)
PermissionError: [Error 5] Access is denied: '\\\\hades\\D$\\buildbot.python.org\\3.x.kloth-win64\\build\\build\\test_python_3612\\@test_3612_tmp\\*.*'

If this is expected or normal, maybe we should simply skip the test when the listdir() call above fails.

[pitrou]

Example URL for the aforementioned failure:

http://buildbot.python.org/all/builders/AMD64%20Windows7%20SP1%203.x/builds/282/steps/test/logs/stdio

[tjguk]

Well os.listdir doesn't fail to access a UNC path on Windows x64 in
general. So presumably this particular path is not accessible by the
buildbot process owner?

[pitrou]

Well, this particular path is the build directory itself, so it's certainly accessible through the normal (non-UNC) path. There has to be something else :-)

Jeremy told me his buildbot process runs as a service, perhaps that is related?

[tjguk]

It's using an administrative share (\\server\d$) and those are usually
restricted with share permissions -- different from NTFS permissions.
That the process runs as a service is likely to have an effect since
services are conventionally run with minimum-privilege accounts.

[pitrou]

It's using an administrative share (\\server\d$) and those are usually
restricted with share permissions -- different from NTFS permissions.
That the process runs as a service is likely to have an effect since
services are conventionally run with minimum-privilege accounts.

Ok, so I guess skipping the test in this case would be appropriate?

[tjguk]

For this particular buildbot setup, maybe yes. But it would be possible
in principle to have a buildbot configuration which could allow the test
to execute. (eg one running under a user account which can access the
path via an admin share). Does the buildbot owner have anything to say
on the account and share permissions?

[jeremykloth]

The buildbot service account is a standard user (per the buildbot
servce installation directions). When logged on, the user can access
the share. Just when logged on as a service is when it cannot.

After much searching, I still cannot find any information on how to
get that user to access to those shares.

[tjguk]

My guess is that it's to do with Service Hardening. I did a quick dump
of my token in an interactive session and as the owner of a service.
Quite a few differences. I haven't read up on this area yet so I'm not
sure what options there are / how easy to get the necessary privs.

[tjguk]

Simplest solution might be to catch PermissionError and call skipTest from within. This would allow buildbots to run the test which had access through the relevant share.

[python-dev]

New changeset 4d480a2a6296 by Antoine Pitrou in branch '3.2':
Issue bpo-15338: skip test_UNC_path when the current user doesn't have enough permissions to access the path.
http://hg.python.org/cpython/rev/4d480a2a6296

New changeset 7d5e84a44b82 by Antoine Pitrou in branch 'default':
Issue bpo-15338: skip test_UNC_path when the current user doesn't have enough permissions to access the path.
http://hg.python.org/cpython/rev/7d5e84a44b82

[python-dev]

New changeset 7eac87fa7a06 by Antoine Pitrou in branch '2.7':
Issue bpo-15338: skip test_UNC_path when the current user doesn't have enough permissions to access the path.
http://hg.python.org/cpython/rev/7eac87fa7a06