From 6233eaa5f03b5818fbec0d69471ae710578dc377 Mon Sep 17 00:00:00 2001 From: Adrian Reber Date: Wed, 17 Jun 2026 12:37:35 +0000 Subject: [PATCH] test: replace insecure tempfile.mktemp with mkstemp tempfile.mktemp is deprecated because it only generates a filename without creating the file, introducing a TOCTOU race condition where another process could create a file with the same name between the mktemp call and the subsequent file operation. Replace it with tempfile.mkstemp, which atomically creates the file and returns a file descriptor, eliminating the race window. Assisted-by: Claude Code (claude-opus-4-6) Signed-off-by: Adrian Reber --- test/zdtm.py | 5 +++-- test/zdtm/criu_config.py | 4 ++-- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/test/zdtm.py b/test/zdtm.py index 6ffc26178..63806d708 100755 --- a/test/zdtm.py +++ b/test/zdtm.py @@ -223,8 +223,9 @@ class ns_flavor: except OSError as e: if e.errno != errno.EEXIST: raise - dst = tempfile.mktemp(".tso", "", - self.root + os.path.dirname(fname)) + fd, dst = tempfile.mkstemp(".tso", "", + self.root + os.path.dirname(fname)) + os.close(fd) shutil.copy2(fname, dst) os.rename(dst, tfname) diff --git a/test/zdtm/criu_config.py b/test/zdtm/criu_config.py index 9fd292747..4325b214e 100644 --- a/test/zdtm/criu_config.py +++ b/test/zdtm/criu_config.py @@ -14,8 +14,8 @@ class criu_config: preload=False, nowait=False): - config_path = tempfile.mktemp(".conf", "criu-%s-" % action) - with open(config_path, "w") as config_fd: + config_fd_raw, config_path = tempfile.mkstemp(".conf", "criu-%s-" % action) + with os.fdopen(config_fd_raw, "w") as config_fd: for arg in args: if arg.startswith("--"): config_fd.write("\n")