On Friday 10 June 2005 06:52 am, Peter Hansen wrote:
> Sorry Terry, but both assumptions are wrong. 

Yes, thanks. I realized that when I read the other replies.
Oh well.   I guess I learned something anyway. ;-)

The interesting question I'd have then, is what happens
if a wrong version .pyc exists and the process does not
have permission to overwrite it?  I understand that if
no permissions exist and no pyc file exists, that the bytecode
will be generated in memory, but not written.  That would
seem to be the correct thing to do, but I wonder if it's what
actually happens here.

I just tried to test this, but I found something even scarier
in the process:

samwise:/project/terry> python
Python 2.3.4 (#2, May 29 2004, 03:31:27)
[GCC 3.3.3 (Debian 20040417)] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> import pkgs
>>>
samwise:/project/terry> su
Password:
samwise:/project/terry# chmod a-w pkgs.pyc
samwise:/project/terry# chown root:root pkgs.pyc
samwise:/project/terry# ls -l pkgs.pyc
-r--r--r--    1 root     root         1628 Jun 10 22:45 pkgs.pyc
samwise:/project/terry# exit
exit
samwise:/project/terry> python2.1
Python 2.1.3+ (#1, Feb 25 2004, 08:52:22)
[GCC 3.3.3 (Debian)] on linux2
Type "copyright", "credits" or "license" for more information.
>>> import pkgs
>>>
samwise:/project/terry> ls -l pkgs.pyc
-rw-rw-r--    1 terry    anansi       1701 Jun 10 22:46 pkgs.pyc
samwise:/project/terry>

It looks to me like Python just deleted a read-only file owned by
root in order to replace it with a new pyc file.  Can somebody
explain that to me?!  Isn't that supposed to be impossible?

(I can only guess that Python is running setuid root in this
situation, and taking advantage of that --- but isn't that, well,
*evil*?)

--
Terry Hancock ( hancock at anansispaceworks.com )
Anansi Spaceworks  http://www.anansispaceworks.com

-- 
http://mail.python.org/mailman/listinfo/python-list

Reply via email to