tempfile.mkstemp and os.fdopen

[billiejoex]

Hi there.
I'm trying to generate a brand new file with a unique name by using
tempfile.mkstemp().
In conjunction I used os.fdopen() to get a wrapper around file
properties (write & read methods, and so on...) but 'name' attribute
does not contain the correct file name. Why?
<fdopen>

Moreover, I'd like to know if I'm doing fine. Does this approach avoid
race conditions or other types of security problems?

Thanks in advance

 

[draghuram]

In conjunction I used os.fdopen() to get a wrapper around file
properties (write & read methods, and so on...) but 'name' attribute
does not contain the correct file name. Why?


<fdopen>

Moreover, I'd like to know if I'm doing fine. Does this approach avoid
race conditions or other types of security problems?

Thanks in advance

There seems to be a feature request for this:

http://bugs.python.org/issue1625576

 

[Michael J. Fromberger]

Hi there.
I'm trying to generate a brand new file with a unique name by using
tempfile.mkstemp().
In conjunction I used os.fdopen() to get a wrapper around file
properties (write & read methods, and so on...) but 'name' attribute
does not contain the correct file name. Why?

<fdopen>

Moreover, I'd like to know if I'm doing fine. Does this approach avoid
race conditions or other types of security problems?

Thanks in advance

In brief, since os.fdopen() only has access to the file descriptor, it
does not have a convenient way to obtain the file's name. However, you
might also want to look at the TemporaryFile and NamedTemporaryFile
classes in the tempfile module -- these expose a file-like API,
including a .name attribute.

Assuming tempfile.mkstemp() is implemented properly, I think what you
are doing should be sufficient to avoid the obvious file-creation race
condition.

Cheers,
-M

 

[Nick Craig-Wood]

I'm trying to generate a brand new file with a unique name by using
tempfile.mkstemp().

Moreover, I'd like to know if I'm doing fine. Does this approach avoid
race conditions

This is a reasonably secure way of doing things. It can't race under
unix at least (dunno about windows) unless your dir is on NFS.

If you want more security then make sure dir isn't publically
writeable.

 

[billiejoex]

Thanks all.
Another question: I have to open file for writing ('wb') but I noticed
that both tempfile.mkstemp() and os.fdopen() accept a "mode" argument.
It's not clear *when* do I have to specify such mode. When using
tempfile.mkstemp?

....or when using os.fdopen()?

Moreover, what happens if I specify "text" mode when using mkstemp and
"binary" mode when using fdopen?


PS - I think that tempfile.mkstemp docstring should be enhanced to
cover such and other questions (e.g. I find reasonable that every user
using tempfile.mkstemp() should use also os.fdopen() in conjunction
but this isn't mentioned).

 

[Gabriel Genellina]

Another question: I have to open file for writing ('wb') but I noticed
that both tempfile.mkstemp() and os.fdopen() accept a "mode" argument.
It's not clear *when* do I have to specify such mode. When using
tempfile.mkstemp?

Moreover, what happens if I specify "text" mode when using mkstemp and
"binary" mode when using fdopen?

PS - I think that tempfile.mkstemp docstring should be enhanced to
cover such and other questions (e.g. I find reasonable that every user
using tempfile.mkstemp() should use also os.fdopen() in conjunction
but this isn't mentioned).

As someone already suggested, why don't you use TemporaryFile or
NamedTemporaryFile and avoid such problems?

 

[Gerard Flanagan]

Hi there.
I'm trying to generate a brand new file with a unique name by using
tempfile.mkstemp().
In conjunction I used os.fdopen() to get a wrapper around file
properties (write & read methods, and so on...) but 'name' attribute
does not contain the correct file name. Why?

import tempfile, os

class TempFile(object):

def __init__(self, fd, fname):
self._fileobj = os.fdopen(fd, 'w+b')
self.name = fname

def __getattr__(self, attr):
return getattr(self._fileobj, attr)

def mktempfile(dir=None, suffix='.tmp'):
return TempFile(*tempfile.mkstemp(dir=dir, suffix=suffix))

 

[Lawrence D'Oliveiro]

... since os.fdopen() only has access to the file descriptor, it
does not have a convenient way to obtain the file's name.

You can do this under Linux as follows:

os.readlink("/proc/%d/fd/%d" % (os.getpid(), fileno))

 

[Nick Craig-Wood]

You can do this under Linux as follows:

os.readlink("/proc/%d/fd/%d" % (os.getpid(), fileno))

A good idea! You can write this slightly more succinctly as

os.readlink("/proc/self/fd/%d" % fileno)

 

[billiejoex]

As someone already suggested, why don't you use TemporaryFile or
NamedTemporaryFile and avoid such problems?

Because I don't want file to be removed after closing.