[issue36656] Allow os.symlink(src, target, force=True) to prevent race conditions

Change by Tom Hale : -- type: security -> enhancement ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe:

[issue36656] Allow os.symlink(src, target, force=True) to prevent race conditions

Tom Hale added the comment: Thanks Toshio Kuratomi, I raised it on the mailing list at: https://code.activestate.com/lists/python-ideas/55992/ -- ___ Python tracker ___

[issue36656] Allow os.symlink(src, target, force=True) to prevent race conditions

Toshio Kuratomi added the comment: Additionally, the os module is supposed to closely follow the behaviour of the underlying operating system functions: https://docs.python.org/3/library/os.html > The design of all built-in operating system dependent modules of Python is > such that as

[issue36656] Allow os.symlink(src, target, force=True) to prevent race conditions

Serhiy Storchaka added the comment: So what? Detected problem is better than non-detected problem. If and unexpected exception causes troubles in your code, it is up to you what to do with it: silence it, terminate an application, try to recreate a symlink in other place, etc. In any case

[issue36656] Allow os.symlink(src, target, force=True) to prevent race conditions

Tom Hale added the comment: Yes, but by default (because of difficulty) people won't check for this case: 1. I delete existing symlink in order to recreate it 2. Attacker watching symlink finds it deleted and recreates it 3. I try to create symlink, and an unexpected exception is raised

[issue36656] Allow os.symlink(src, target, force=True) to prevent race conditions

Serhiy Storchaka added the comment: If the symlink can be recreated, it can also be changed after creation. -- nosy: +serhiy.storchaka ___ Python tracker ___

[issue36656] Allow os.symlink(src, target, force=True) to prevent race conditions

Tom Hale added the comment: The most correct work-around I believe exists is: (updates at: https://stackoverflow.com/a/55742015/5353461) def symlink_force(target, link_name): ''' Create a symbolic link pointing to target named link_name. Overwrite target if it

[issue36656] Allow os.symlink(src, target, force=True) to prevent race conditions

New submission from Tom Hale : I cannot find a race-condition-free way to force overwrite an existing symlink. os.symlink() requires that the target does not exist, meaning that it could be created via race condition the two workaround solutions that I've seen: 1. Unlink existing symlink