certbot.compat.filesystem module

Compat module to handle files security on Windows and Linux

certbot.compat.filesystem.chmod(file_path: str, mode: int) → None[source]
Apply a POSIX mode on given file_path:
  • for Linux, the POSIX mode will be directly applied using chmod,

  • for Windows, the POSIX mode will be translated into a Windows DACL that make sense for Certbot context, and applied to the file using kernel calls.

The definition of the Windows DACL that correspond to a POSIX mode, in the context of Certbot, is explained at https://github.com/certbot/certbot/issues/6356 and is implemented by the method _generate_windows_flags().

Parameters
  • file_path (str) – Path of the file

  • mode (int) – POSIX mode to apply

certbot.compat.filesystem.copy_ownership_and_apply_mode(src: str, dst: str, mode: int, copy_user: bool, copy_group: bool) → None[source]

Copy ownership (user and optionally group on Linux) from the source to the destination, then apply given mode in compatible way for Linux and Windows. This replaces the os.chown command. :param str src: Path of the source file :param str dst: Path of the destination file :param int mode: Permission mode to apply on the destination file :param bool copy_user: Copy user if True :param bool copy_group: Copy group if True on Linux (has no effect on Windows)

certbot.compat.filesystem.check_mode(file_path: str, mode: int) → bool[source]

Check if the given mode matches the permissions of the given file. On Linux, will make a direct comparison, on Windows, mode will be compared against the security model. :param str file_path: Path of the file :param int mode: POSIX mode to test :rtype: bool :return: True if the POSIX mode matches the file permissions

certbot.compat.filesystem.check_owner(file_path: str) → bool[source]

Check if given file is owned by current user. :param str file_path: File path to check :rtype: bool :return: True if given file is owned by current user, False otherwise.

certbot.compat.filesystem.check_permissions(file_path: str, mode: int) → bool[source]

Check if given file has the given mode and is owned by current user. :param str file_path: File path to check :param int mode: POSIX mode to check :rtype: bool :return: True if file has correct mode and owner, False otherwise.

certbot.compat.filesystem.open(file_path: str, flags: int, mode: int = 511) → int[source]

Wrapper of original os.open function, that will ensure on Windows that given mode is correctly applied. :param str file_path: The file path to open :param int flags: Flags to apply on file while opened :param int mode: POSIX mode to apply on file when opened,

Python defaults will be applied if None

Returns

the file descriptor to the opened file

Return type

int

Raise

OSError(errno.EEXIST) if the file already exists and os.O_CREAT & os.O_EXCL are set, OSError(errno.EACCES) on Windows if the file already exists and is a directory, and

os.O_CREAT is set.

certbot.compat.filesystem.makedirs(file_path: str, mode: int = 511) → None[source]

Rewrite of original os.makedirs function, that will ensure on Windows that given mode is correctly applied. :param str file_path: The file path to open :param int mode: POSIX mode to apply on leaf directory when created, Python defaults

will be applied if None

certbot.compat.filesystem.mkdir(file_path: str, mode: int = 511) → None[source]

Rewrite of original os.mkdir function, that will ensure on Windows that given mode is correctly applied. :param str file_path: The file path to open :param int mode: POSIX mode to apply on directory when created, Python defaults

will be applied if None

certbot.compat.filesystem.replace(src: str, dst: str) → None[source]

Rename a file to a destination path and handles situations where the destination exists. :param str src: The current file path. :param str dst: The new file path.

certbot.compat.filesystem.realpath(file_path: str) → str[source]

Find the real path for the given path. This method resolves symlinks, including recursive symlinks, and is protected against symlinks that creates an infinite loop.

certbot.compat.filesystem.is_executable(path: str) → bool[source]

Is path an executable file? :param str path: path to test :return: True if path is an executable file :rtype: bool

certbot.compat.filesystem.has_world_permissions(path: str) → bool[source]

Check if everybody/world has any right (read/write/execute) on a file given its path :param str path: path to test :return: True if everybody/world has any right to the file :rtype: bool

certbot.compat.filesystem.compute_private_key_mode(old_key: str, base_mode: int) → int[source]

Calculate the POSIX mode to apply to a private key given the previous private key :param str old_key: path to the previous private key :param int base_mode: the minimum modes to apply to a private key :return: the POSIX mode to apply :rtype: int

certbot.compat.filesystem.has_same_ownership(path1: str, path2: str) → bool[source]

Return True if the ownership of two files given their respective path is the same. On Windows, ownership is checked against owner only, since files do not have a group owner. :param str path1: path to the first file :param str path2: path to the second file :return: True if both files have the same ownership, False otherwise :rtype: bool

certbot.compat.filesystem.has_min_permissions(path: str, min_mode: int) → bool[source]

Check if a file given its path has at least the permissions defined by the given minimal mode. On Windows, group permissions are ignored since files do not have a group owner. :param str path: path to the file to check :param int min_mode: the minimal permissions expected :return: True if the file matches the minimal permissions expectations, False otherwise :rtype: bool