System Integrity Protection breaks shutil.copystat()

[rgov]

BPO	32347
Nosy	@ronaldoussoren, @giampaolo, @ned-deily, @rgov
PRs	bpo-32347: Emulate Libc copyfiles()'s st_flags logic on Darwin #4912

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = None
closed_at = None
created_at = <Date 2017-12-16.16:45:00.982>
labels = ['OS-mac', 'type-bug']
title = 'System Integrity Protection breaks shutil.copystat()'
updated_at = <Date 2018-06-12.09:40:25.312>
user = 'https://github.com/rgov'

bugs.python.org fields:

activity = <Date 2018-06-12.09:40:25.312>
actor = 'giampaolo.rodola'
assignee = 'none'
closed = False
closed_date = None
closer = None
components = ['macOS']
creation = <Date 2017-12-16.16:45:00.982>
creator = 'Ryan Govostes'
dependencies = []
files = []
hgrepos = []
issue_num = 32347
keywords = ['patch']
message_count = 1.0
messages = ['308479']
nosy_count = 4.0
nosy_names = ['ronaldoussoren', 'giampaolo.rodola', 'ned.deily', 'Ryan Govostes']
pr_nums = ['4912']
priority = 'normal'
resolution = None
stage = 'patch review'
status = 'open'
superseder = None
type = 'behavior'
url = 'https://bugs.python.org/issue32347'
versions = ['Python 3.6']

[rgov]

On macOS, shutil.copystat() uses chflags() to try to copy filesystem flags from the source to destination.

In recent years, Apple introduced System Integrity Protection, which prevents modification of system files. These files have the non-standard SF_RESTRICTED flag set, which only the superuser can set.

Thus, unprivileged users can no longer use shutil.copy2() et al. to copy system files, which is a regression from previous releases of the OS.

It's unclear what the correct behavior should be: It some cases, it would be desirable to attempt to copy the bit.

It might be informative to look at the behavior of Apple's copyfile_stat function, which unsets these two flags:

   /*
    * File flags that are not preserved when copying stat information.
    */
   #define COPYFILE_OMIT_FLAGS 	(UF_TRACKED | SF_RESTRICTED)

https://opensource.apple.com/source/copyfile/copyfile-146/copyfile.c.auto.html

This was also filed to Apple as rdar://36090921

[ofek]

I am also affected by this