From af459e5e3206bf1469b6940e058e7d4bd44c5af8 Mon Sep 17 00:00:00 2001 From: "Miss Islington (bot)" <31488909+miss-islington@users.noreply.github.com> Date: Tue, 16 Jun 2026 18:42:20 +0200 Subject: [PATCH] [3.14] gh-151519: Check effective gid in `_test_all_chown_common` group-0 guard (GH-151521) (#151550) gh-151519: Check effective gid in `_test_all_chown_common` group-0 guard (GH-151521) The guard that skips the "chown to gid 0 should fail" assertion used only `os.getgroups()` (supplementary groups). The kernel also accepts the effective/filesystem gid for chown, so when a process runs with egid 0 and a non-zero uid (common in containers and user namespaces), chown(-1, 0) succeeds and the assertion spuriously fails. Add an `os.getegid() != 0` check alongside the existing `0 not in os.getgroups()` guard. (cherry picked from commit 2ce260033b457a0ad2c9767a1d9902bef5a30b0e) Co-authored-by: Itamar Oren --- Lib/test/test_posix.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/Lib/test/test_posix.py b/Lib/test/test_posix.py index a895d57d1ffe..31657bdc9d44 100644 --- a/Lib/test/test_posix.py +++ b/Lib/test/test_posix.py @@ -838,7 +838,9 @@ class PosixTester(unittest.TestCase): self.assertRaises(OSError, chown_func, first_param, 0, -1) check_stat(uid, gid) if hasattr(os, 'getgroups'): - if 0 not in os.getgroups(): + # Also check the effective gid, which the kernel + # accepts for chown even if not in getgroups(). + if 0 not in os.getgroups() and os.getegid() != 0: self.assertRaises(OSError, chown_func, first_param, -1, 0) check_stat(uid, gid) # test illegal types -- 2.47.3