racecondition

[DhirajMishra]

BPO	34209
Nosy	@methane

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = None
closed_at = <Date 2018-07-27.09:44:13.930>
created_at = <Date 2018-07-24.14:31:37.402>
labels = ['type-security', 'build', 'invalid']
title = 'racecondition'
updated_at = <Date 2018-07-27.09:44:13.929>
user = 'https://bugs.python.org/DhirajMishra'

bugs.python.org fields:

activity = <Date 2018-07-27.09:44:13.929>
actor = 'methane'
assignee = 'none'
closed = True
closed_date = <Date 2018-07-27.09:44:13.930>
closer = 'methane'
components = ['Build']
creation = <Date 2018-07-24.14:31:37.402>
creator = 'Dhiraj_Mishra'
dependencies = []
files = []
hgrepos = []
issue_num = 34209
keywords = []
message_count = 2.0
messages = ['322305', '322334']
nosy_count = 2.0
nosy_names = ['methane', 'Dhiraj_Mishra']
pr_nums = []
priority = 'normal'
resolution = 'not a bug'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'security'
url = 'https://bugs.python.org/issue34209'
versions = ['Python 2.7']

[DhirajMishra]

File: /cpython/blob/master/Modules/posixmodule.c#L2657

#endif
        result = access(path->narrow, mode);
    Py_END_ALLOW_THREADS
    return_value = !result;
#endif

If an attacker could change anything along the path between the call access() and the files actually used, it may exploit the race condition or a time-of-check, time-of-use race condition

https://linux.die.net/man/2/access

[methane]

https://docs.python.org/3/library/os.html#os.access
It is already documented. What's point of this issue?