Allow to change permissions of temp directories created with tmp_path

[GianlucaFicarelli]

What's the problem this feature will solve?

Any temp directory created with the fixture tmp_path has read/write permissions only for the specific user running the tests because mode is set to 0o700.
Although this is probably motivated by security concerns, there are scenarios where more relaxed permissions can be useful.

Describe the solution you'd like

I'd like to be able to override the 0o700 mode that is currently hardcoded in pytest.

For example, the tests may be run in a CI pipeline by a special service user, that's different from the user that should investigate any possible error.
If the mode is set 0o750 and the users belong to the same group, the second user would be able to read the temp files.

Alternative Solutions

I tried to enforce chmod on the temp directory after the tests are executed, but this adds complexity and it's not enough if the pipeline is killed due to a timeout.

[The-Compiler]

Given the security implications (as you say), I'm a bit lukewarm on the idea of allowing to change it in a config file or somesuch. Why not something like (untested):

@pytest.fixture
def permissive_tmp_path(tmp_path):
    tmp_path.chmod(0o775)
    return tmp_path

and use that fixture where you need it?

[GianlucaFicarelli]

The modified fixture would almost work, but, since the layout of directories is (assuming to execute pytest --basetemp=/tmp/mybasetemp ...):

mybasetemp
├── test_tmp0
│   └── out.txt
└── test_tmpcurrent -> /private/tmp/mybasetemp/test_tmp0

both mybasetemp and test_tmp0 need the permissions fixed, so the fixture could be:

@pytest.fixture
def permissive_tmp_path(tmp_path):
    tmp_path.chmod(0o775)
    tmp_path.parent.chmod(0o775)
    return tmp_path

However this isn't enough when using pytest-xdist, because in that case the layout of directories has an additional level like in this example:

mybasetemp
└── popen-gw0
    ├── test_tmp0
    │   └── out.txt
    └── test_tmpcurrent -> /private/tmp/mybasetemp/popen-gw0/test_tmp0

Do you have any idea on how to handle both the cases?

[The-Compiler]

I suppose you could check if running in xdist and then handle that case appropriately.

Or you could perhaps override tmp_path_factory with your own fixture instead, and pytest's tmp_path should pick that one up - though I haven't tried if that actually works.

[GianlucaFicarelli]

Overriding tmp_path_factory is possible, but it seems not enough because pytest-xdist calls directly self.config._tmp_path_factory.getbasetemp() in https://github.com/pytest-dev/pytest-xdist/blob/9373ddb3f841a009bc9669b514923b6ecba724e7/src/xdist/workermanage.py#L272
and the original basedir is still created with the hardcoded permissions.

However, checking if running in xdist works as you suggested, so I ended up with this in conftest.py (working with tmp_path, while it would need additional changes to work with tmp_path_factory but it's not needed at the moment):

def pytest_addoption(parser):
    parser.addoption(
        "--basetemp-permissions",
        action="store",
        help=(
            "Permissions of the base temporary directory used by tmp_path, "
            "as octal value. Examples: 700 (default), 750, 770"
        ),
    )


@pytest.fixture
def tmp_path(tmp_path, request):
    permissions = request.config.getoption("--basetemp-permissions")
    if permissions:
        permissions = int(permissions, 8)
        # enforce the permissions according to the temp directory layout:
        # - <basetemp>/test_<name>, when running without pytest-xdist
        # - <basetemp>/popen-gw<num>/test_<name>, when running with pytest-xdist
        tmp_path.chmod(permissions)
        tmp_path.parent.chmod(permissions)
        if os.getenv("PYTEST_XDIST_WORKER_COUNT"):
            tmp_path.parent.parent.chmod(permissions)
    return tmp_path

and pytest can be executed with

pytest --basetemp mybasetemp  --basetemp-permissions 750