Skip to content

create debugger tmp directory with 0o700 permissions#1530

Open
sahvx655-wq wants to merge 1 commit into
ipython:mainfrom
sahvx655-wq:debugger-tmp-dir-mode
Open

create debugger tmp directory with 0o700 permissions#1530
sahvx655-wq wants to merge 1 commit into
ipython:mainfrom
sahvx655-wq:debugger-tmp-dir-mode

Conversation

@sahvx655-wq

Copy link
Copy Markdown

While looking at where the debugger persists cell sources, I noticed Debugger.start creates the scratch directory with Path(tmp_dir).mkdir(parents=True) and no mode argument. get_tmp_directory() returns a predictable <tmpdir>/ipykernel_<pid>, so on a typical umask the directory lands at 0o755 and the cell files dumpCell writes into it come out 0o644. On a shared host any other local user can then read the source the user is debugging. Checking the mode locally confirmed 0o755 on the directory and 0o644 on the written .py files.

The connection directory in kernelapp.init_connection_file is already created with mode=0o700 for the same reason, so this brings the debugger scratch directory in line. Setting the mode at creation keeps the restriction next to the only place the directory is made, rather than relying on the ambient umask being tight.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants