runspec-linux-core 0.6.0__tar.gz → 0.6.2__tar.gz

{runspec_linux_core-0.6.0 → runspec_linux_core-0.6.2}/CHANGELOG.md

@@ -1,5 +1,38 @@
 # runspec-linux-core Changelog
 
+## [0.6.2] — 2026-09-17
+
+### Fixed
+
+- **`install_into_venv` regression (0.6.1): `chmod: … Operation not permitted` on
+  a `--symlinks` venv's `bin/python*`.** 0.6.1 replaced the `chmod -R` normalise
+  sweep with `find … -exec chmod {} +` to prune the `logs/` dir. But `find -exec
+  chmod` **dereferences a symlink argument**, and a venv built with `--symlinks`
+  (what `create_venv` always does) has `bin/python`, `bin/python3`,
+  `bin/python3.X` pointing at the **root-owned system interpreter outside the
+  venv** — so the sweep tried to `chmod /usr/bin/python3.X` and failed for a
+  non-root caller (or, under sudo, would have silently repermissioned the system
+  Python). `chmod -R` skipped symlinks for free; the `find` sweep now prunes them
+  explicitly too (`-type l -prune`), matching the old behaviour. A symlink's own
+  mode is unused on Linux, so nothing is lost. The `logs/` prune from 0.6.1 is
+  unchanged. No API change.
+
+## [0.6.1] — 2026-09-17
+
+### Fixed
+
+- **`install_into_venv` no longer fails with `chmod: … Operation not permitted`
+  on a venv with root-owned logs.** The post-install permission-normalisation
+  step ran a blanket `chmod -R u=rwX,go=rX <venv>` over the *whole* tree —
+  including `<venv>/logs`, the group-shared (`2775`) audit directory. A
+  `run_as="root"` runnable (`list-upgrades` / `upgrade-packages`) leaves
+  **root-owned** per-run log files there, so a non-root caller's `chmod` hit them
+  with "Operation not permitted" and the install reported failure. The sweep now
+  uses `find <venv> -path <venv>/logs -prune -o -exec chmod u=rwX,go=rX {} +`,
+  which skips the `logs` subtree entirely (its `2775` mode is left intact and
+  still restored afterwards as a guard). Site-packages normalisation is
+  unchanged. No API change.
+
 ## [0.6.0] — 2026-08-24
 
 New `runspec_linux_core.cron` module — pure helpers for managing a user's

{runspec_linux_core-0.6.0 → runspec_linux_core-0.6.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: runspec-linux-core
-Version: 0.6.0
+Version: 0.6.2
 Summary: Pure-Python Linux system-admin helpers — the importable core behind runspec-linux (no runspec dependency, no runnables)
 Requires-Python: >=3.10
 Provides-Extra: dev

{runspec_linux_core-0.6.0 → runspec_linux_core-0.6.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "runspec-linux-core"
-version = "0.6.0"
+version = "0.6.2"
 requires-python = ">=3.10"
 description = "Pure-Python Linux system-admin helpers — the importable core behind runspec-linux (no runspec dependency, no runnables)"
 dependencies = []

{runspec_linux_core-0.6.0 → runspec_linux_core-0.6.2}/runspec_linux_core/venvs.py

@@ -140,8 +140,15 @@ def install_into_venv(
     regardless of the caller's umask — a ``sudo`` upgrade under a PAM-set ``027``
     login umask otherwise lands site-packages entries at ``750`` and hides the
     packs from ``runspec local`` / ``importlib.metadata`` for anyone but the
-    owner. If ``<venv>/logs`` exists (``create_venv`` leaves it there), its
-    ``2775`` setgid mode is restored after the wide chmod strips it.
+    owner. The sweep **prunes** two things: ``<venv>/logs`` (the group-shared
+    audit dir, which holds per-run log files owned by other users — a
+    ``run_as="root"`` runnable leaves root-owned logs there — so its ``2775``
+    setgid mode is left intact and restored afterwards as a guard), and
+    **symlinks** (a ``--symlinks`` venv's ``bin/python*`` point at the root-owned
+    system interpreter *outside* the venv; ``find -exec chmod`` would dereference
+    them and fail — or, under sudo, silently repermission the system Python —
+    where ``chmod -R`` skipped symlinks for free). A symlink's own mode is unused
+    on Linux, so pruning them changes nothing.
     """
     from runspec_linux_core.packages import _validate_packages
 
@@ -173,8 +180,50 @@ def install_into_venv(
     result = _run(cmd)
     _check(result, "pip install", run_as)
 
-    _check(_run(build_become(["chmod", "-R", "u=rwX,go=rX", venv], run_as, become_method)), "chmod venv", run_as)
+    # Normalise pip's freshly-created site-packages entries to u=rwX,go=rX (the
+    # same step create_venv runs) so a sudo install under a restrictive login
+    # umask can't land them at 750 and hide the packs from `runspec local` /
+    # importlib.metadata. Two subtrees are pruned:
+    #   * <venv>/logs — the group-shared (2775) audit dir, which accrues per-run
+    #     log files owned by *other* users (a run_as="root" runnable such as
+    #     list-upgrades / upgrade-packages leaves root-owned logs there), so a
+    #     non-root caller's chmod on them dies with "Operation not permitted".
+    #   * symlinks (-type l) — a `--symlinks` venv's bin/python* point at the
+    #     system interpreter (root-owned, *outside* the venv). `find -exec chmod`
+    #     dereferences a symlink argument, so without this it would chmod the
+    #     system python: "Operation not permitted" as a normal user, or a silent
+    #     repermission of /usr/bin/python* under sudo. `chmod -R` skipped symlinks
+    #     for free; the find sweep must skip them explicitly to match. A symlink's
+    #     own mode is irrelevant on Linux, so nothing is lost.
+    # The logs dir keeps its 2775 mode (restored below as a belt-and-braces guard).
     logs_dir = os.path.join(venv, "logs")
+    _check(
+        _run(
+            build_become(
+                [
+                    "find",
+                    venv,
+                    "-path",
+                    logs_dir,
+                    "-prune",
+                    "-o",
+                    "-type",
+                    "l",
+                    "-prune",
+                    "-o",
+                    "-exec",
+                    "chmod",
+                    "u=rwX,go=rX",
+                    "{}",
+                    "+",
+                ],
+                run_as,
+                become_method,
+            )
+        ),
+        "chmod venv",
+        run_as,
+    )
     if _run(build_become(["test", "-d", logs_dir], run_as, become_method)).returncode == 0:
         _check(_run(build_become(["chmod", "2775", logs_dir], run_as, become_method)), "chmod logs", run_as)
 

{runspec_linux_core-0.6.0 → runspec_linux_core-0.6.2}/tests/test_venvs.py

@@ -148,21 +148,48 @@ def test_install_into_venv_normalises_perms(tmp_path, monkeypatch: pytest.Monkey
 
     venvs.install_into_venv(venv, "httpx", upgrade=True, run_as="svc")
 
-    assert ["sudo", "-n", "-u", "svc", "chmod", "-R", "u=rwX,go=rX", venv] in calls
-    # logs_dir exists (the default stub returns 0 for `test -d`), so the setgid
-    # mode is restored after the wide chmod would have stripped it.
+    # The normalise sweep prunes <venv>/logs (root-owned per-run logs a
+    # run_as="root" runnable leaves there) AND symlinks (a --symlinks venv's
+    # bin/python* point at the root-owned system interpreter; find -exec chmod
+    # would dereference and fail / repermission it). Otherwise: chmod "Operation
+    # not permitted", and the install reports failure.
+    assert [
+        "sudo",
+        "-n",
+        "-u",
+        "svc",
+        "find",
+        venv,
+        "-path",
+        f"{venv}/logs",
+        "-prune",
+        "-o",
+        "-type",
+        "l",
+        "-prune",
+        "-o",
+        "-exec",
+        "chmod",
+        "u=rwX,go=rX",
+        "{}",
+        "+",
+    ] in calls
+    # No blanket `chmod -R` over the whole tree any more.
+    assert not any(c[-4:] == ["chmod", "-R", "u=rwX,go=rX", venv] for c in calls)
+    # logs_dir exists (the default stub returns 0 for `test -d`), so its 2775 mode
+    # is restored as a guard.
     assert ["sudo", "-n", "-u", "svc", "test", "-d", f"{venv}/logs"] in calls
     assert ["sudo", "-n", "-u", "svc", "chmod", "2775", f"{venv}/logs"] in calls
-    # And the chmod steps run *after* the pip install (order matters — pip
+    # And the normalise sweep runs *after* the pip install (order matters — pip
     # creates the dirs we're normalising).
     pip_i = next(i for i, c in enumerate(calls) if "pip" in c and "install" in c)
-    chmod_i = next(i for i, c in enumerate(calls) if "chmod" in c and "u=rwX,go=rX" in c)
+    chmod_i = next(i for i, c in enumerate(calls) if "find" in c and "u=rwX,go=rX" in c)
     assert chmod_i > pip_i
 
 
 def test_install_into_venv_skips_logs_restore_when_absent(tmp_path, monkeypatch: pytest.MonkeyPatch) -> None:
-    """A venv without a logs/ dir (not built by create_venv) gets the wide chmod
-    but no 2775 restore — the test -d guard skips the logs step."""
+    """A venv without a logs/ dir (not built by create_venv) gets the normalise
+    sweep but no 2775 restore — the test -d guard skips the logs step."""
     venv = _fake_venv(tmp_path, monkeypatch)
     calls: list[list[str]] = []
 
@@ -177,7 +204,23 @@ def test_install_into_venv_skips_logs_restore_when_absent(tmp_path, monkeypatch:
 
     venvs.install_into_venv(venv, "httpx")
 
-    assert ["chmod", "-R", "u=rwX,go=rX", venv] in calls
+    assert [
+        "find",
+        venv,
+        "-path",
+        f"{venv}/logs",
+        "-prune",
+        "-o",
+        "-type",
+        "l",
+        "-prune",
+        "-o",
+        "-exec",
+        "chmod",
+        "u=rwX,go=rX",
+        "{}",
+        "+",
+    ] in calls
     assert ["test", "-d", f"{venv}/logs"] in calls
     assert not any(c[:2] == ["chmod", "2775"] for c in calls)