virtualenv: Seeded files retain permissions from an older cache

#!/usr/bin/env python3
import glob
import os
import shutil
import stat
import subprocess
import sys
from pathlib import Path

sys.stdout.reconfigure(line_buffering=True)  # keep these lines in order with those of the child processes
os.umask(0o022)  # for the directories made here as root
OWNER, OTHER_USER = 1000, 65534  # root is only needed to switch to these two unprivileged uids
VIRTUALENV = ["virtualenv", "--quiet", "--no-periodic-update"]  # default seeder; no network for the update check
# read here, as root: /tmp/repro.d need not be readable by the other user
ATTACK = Path("/tmp/repro.d/other_user_appends_to_pip.py").read_text()


def run_as_owner(command, home, umask):
    environ = {"HOME": str(home), "PATH": os.environ["PATH"]}
    subprocess.run(command, user=OWNER, group=OWNER, extra_groups=[], umask=umask, env=environ, cwd=home, check=True)


def mode(path):
    return stat.filemode(os.stat(path).st_mode)


work = Path("/tmp/seed-mode-repro")
shutil.rmtree(work, ignore_errors=True)
work.mkdir()
proofs = work / "proofs"
proofs.mkdir()
proofs.chmod(0o777)  # the other user's line writes the uid it runs as in here

writable_by_others, appended_line_ran_as = {}, {}
# the two histories differ only in the umask of the owner's earlier run, the one that fills ~/.cache/virtualenv
for case, umask_of_earlier_run in [("CONTROL", 0o022), ("OBSERVED", 0o000)]:
    # set up: the owner's home, and with it the cache, is private; the project folder is reachable by path
    home = work / f"{case}-home"
    home.mkdir(mode=0o700)
    os.chown(home, OWNER, OWNER)
    projects = work / f"{case}-projects"
    projects.mkdir(mode=0o755)
    os.chown(projects, OWNER, OWNER)

    # owner, some time ago: the first run, with an empty cache, extracts the pip wheel into it
    run_as_owner([*VIRTUALENV, str(home / "earlier-env")], home, umask=umask_of_earlier_run)
    # owner, today
    env = projects / "env"
    run_as_owner([*VIRTUALENV, str(env)], home, umask=0o022)

    (cached_pip,) = glob.glob(f"{home}/.cache/virtualenv/wheel/*/image/1/CopyPipInstall/pip-*/pip/__init__.py")
    (seeded_pip,) = glob.glob(f"{env}/lib/python*/site-packages/pip/__init__.py")
    env_files = [path for path in env.rglob("*") if path.is_file() and not path.is_symlink()]
    writable_by_others[case] = sum(1 for path in env_files if path.stat().st_mode & stat.S_IWOTH)
    print(f"{case} earlier run under umask {umask_of_earlier_run:03o}, env created under umask 022")
    print(f"{case}   cache pip/__init__.py  {mode(cached_pip)}")
    print(f"{case}   env   pyvenv.cfg       {mode(env / 'pyvenv.cfg')}")
    print(f"{case}   env   bin/activate     {mode(env / 'bin' / 'activate')}")
    print(f"{case}   env   pip/__init__.py  {mode(seeded_pip)}")
    print(f"{case}   env files writable by others: {writable_by_others[case]} of {len(env_files)}")

    # attack: another local user appends a line to the owner's seeded pip
    proof = proofs / case
    subprocess.run(
        ["python3", "-", str(env), str(proof)],
        input=ATTACK,
        text=True,
        user=OTHER_USER,
        group=OTHER_USER,
        extra_groups=[],
        env={"PATH": os.environ["PATH"]},
        cwd="/",
        check=True,
    )

    # the owner uses the environment
    run_as_owner([str(env / "bin" / "pip"), "--version"], home, umask=0o022)
    appended_line_ran_as[case] = proof.read_text() if proof.exists() else None
    print(f"{case}   other user's line ran as uid: {appended_line_ran_as[case]}")

# check: the same umask 022 today must give the same modes, whatever umask filled the cache earlier
control_is_private = writable_by_others["CONTROL"] == 0 and appended_line_ran_as["CONTROL"] is None
observed_runs_as_owner = writable_by_others["OBSERVED"] > 0 and appended_line_ran_as["OBSERVED"] == str(OWNER)
print("BUG" if control_is_private and observed_runs_as_owner else "OK")

import glob
import sys

environment, proof = sys.argv[1:]
(pip_init,) = glob.glob(f"{environment}/lib/python*/site-packages/pip/__init__.py")
added_line = f"\nimport os; open({proof!r}, 'w').write(str(os.getuid()))\n"

try:
    with open(pip_init, "a") as pip_source:
        pip_source.write(added_line)
    print(f"other user: appended a line to {pip_init}")
except PermissionError as error:
    print(f"other user: {error}")