Fix race condition in copyfile() causing inotify permission errors - #68860
Open
wblinux wants to merge 2 commits into
Open
Fix race condition in copyfile() causing inotify permission errors#68860wblinux wants to merge 2 commits into
wblinux wants to merge 2 commits into
Conversation
dwoz
previously approved these changes
Apr 5, 2026
dwoz
force-pushed
the
fix/copyfile-set-perms-before-move
branch
from
April 5, 2026 23:38
ae8cd5f to
e410856
Compare
dwoz
force-pushed
the
fix/copyfile-set-perms-before-move
branch
from
June 7, 2026 05:56
6077600 to
49c8e00
Compare
dwoz
force-pushed
the
fix/copyfile-set-perms-before-move
branch
from
June 26, 2026 13:06
49c8e00 to
197b3a9
Compare
twangboy
previously approved these changes
Jul 13, 2026
Contributor
|
Please rebase and address conflicts |
wblinux
force-pushed
the
fix/copyfile-set-perms-before-move
branch
from
July 14, 2026 12:28
197b3a9 to
c65a11c
Compare
added 2 commits
July 15, 2026 11:33
Apply the destination file's ownership and permissions to the temp file BEFORE the atomic move, instead of after. Previously, mkstemp() created the temp file with default 0600 permissions. After shutil.move() atomically replaced the destination, there was a brief window where the file was visible with restrictive permissions. Services using inotify to watch managed files (e.g. nscd watching /etc/resolv.conf) would detect the replacement via IN_DELETE_SELF, then fail to re-add a file watch with "Permission denied" due to the 0600 permissions, leading to service failures such as DNS resolution loss. By setting chown/chmod on the temp file before shutil.move(), the destination file is never visible with incorrect permissions, eliminating the race condition entirely. Fixes saltstack#65651
- Replace open() with salt.utils.files.fopen() to satisfy W8470 and W1514 - Reformat multi-line with-patch statement for black compliance
twangboy
force-pushed
the
fix/copyfile-set-perms-before-move
branch
from
July 15, 2026 17:33
c65a11c to
266e3aa
Compare
twangboy
approved these changes
Jul 15, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do?
Moves
chown/chmodfrom aftershutil.move()to before it insalt.utils.files.copyfile(), applying the destination file'sownership and permissions to the temp file before the atomic rename.
What issues does this PR fix or reference?
Fixes #65651
Previous Behavior
mkstemp()created a temp file with default0600permissions.shutil.move()atomically replaced the destination, thenchown/chmodwas applied afterward. This left a brief window where the destination
file had restrictive permissions. Services using inotify (e.g. nscd
watching
/etc/resolv.conf) would detect the replacement viaIN_DELETE_SELF, fail to re-add a file watch with "Permission denied",and lose functionality (e.g. DNS resolution failure).
New Behavior
Ownership and permissions are applied to the temp file before
shutil.move(), so the destination file is never visible withincorrect permissions. If
chown/chmodfails, the temp file iscleaned up and the error is propagated.
Merge requirements satisfied?
Commits signed with GPG?
No