tempfile.mkstem p and os.fdopen

[billiejoex]

Hi there.
I'm trying to generate a brand new file with a unique name by using
tempfile.mkstem p().
In conjunction I used os.fdopen() to get a wrapper around file
properties (write & read methods, and so on...) but 'name' attribute
does not contain the correct file name. Why?

>>import os
import tempfile
fileno, name = tempfile.mkstem p(prefix='ftpd. ', dir=os.getcwd() )
fd = os.fdopen(filen o, 'wb')
fd.name

<fdopen>

Moreover, I'd like to know if I'm doing fine. Does this approach avoid
race conditions or other types of security problems?

Thanks in advance

[draghuram]

On Aug 28, 1:55 pm, billiejoex <gne...@gmail.c omwrote:

In conjunction I used os.fdopen() to get a wrapper around file
properties (write & read methods, and so on...) but 'name' attribute
does not contain the correct file name. Why?

>import os
import tempfile
fileno, name = tempfile.mkstem p(prefix='ftpd. ', dir=os.getcwd() )
fd = os.fdopen(filen o, 'wb')
fd.name

<fdopen>

Moreover, I'd like to know if I'm doing fine. Does this approach avoid
race conditions or other types of security problems?

Thanks in advance

There seems to be a feature request for this:

http://bugs.python.org/issue1625576

[Michael J. Fromberger]

In article <11************ **********@19g2 000hsx.googlegr oups.com>,
billiejoex <gn****@gmail.c omwrote:

Hi there.
I'm trying to generate a brand new file with a unique name by using
tempfile.mkstem p().
In conjunction I used os.fdopen() to get a wrapper around file
properties (write & read methods, and so on...) but 'name' attribute
does not contain the correct file name. Why?

>import os
import tempfile
fileno, name = tempfile.mkstem p(prefix='ftpd. ', dir=os.getcwd() )
fd = os.fdopen(filen o, 'wb')
fd.name

<fdopen>

Moreover, I'd like to know if I'm doing fine. Does this approach avoid
race conditions or other types of security problems?

Thanks in advance

In brief, since os.fdopen() only has access to the file descriptor, it
does not have a convenient way to obtain the file's name. However, you
might also want to look at the TemporaryFile and NamedTemporaryF ile
classes in the tempfile module -- these expose a file-like API,
including a .name attribute.

Assuming tempfile.mkstem p() is implemented properly, I think what you
are doing should be sufficient to avoid the obvious file-creation race
condition.

Cheers,
-M

--
Michael J. Fromberger | Lecturer, Dept. of Computer Science
http://www.dartmouth.edu/~sting/ | Dartmouth College, Hanover, NH, USA

[Nick Craig-Wood]

billiejoex <gn****@gmail.c omwrote:

I'm trying to generate a brand new file with a unique name by using
tempfile.mkstem p().

Moreover, I'd like to know if I'm doing fine. Does this approach avoid
race conditions

This is a reasonably secure way of doing things. It can't race under
unix at least (dunno about windows) unless your dir is on NFS.

If you want more security then make sure dir isn't publically
writeable.

--
Nick Craig-Wood <ni**@craig-wood.com-- http://www.craig-wood.com/nick

[billiejoex]

Thanks all.
Another question: I have to open file for writing ('wb') but I noticed
that both tempfile.mkstem p() and os.fdopen() accept a "mode" argument.
It's not clear *when* do I have to specify such mode. When using
tempfile.mkstem p?

>>fileno, name = tempfile.mkstem p(text=False)
fd = os.fdopen(filen o)

....or when using os.fdopen()?

>>fileno, name = tempfile.mkstem p()
fd = os.fdopen(filen o, mode='wb')

Moreover, what happens if I specify "text" mode when using mkstemp and
"binary" mode when using fdopen?

>>fileno, name = tempfile.mkstem p(text=True)
fd = os.fdopen(filen o, 'wb')

PS - I think that tempfile.mkstem p docstring should be enhanced to
cover such and other questions (e.g. I find reasonable that every user
using tempfile.mkstem p() should use also os.fdopen() in conjunction
but this isn't mentioned).

[Gabriel Genellina]

On 28 ago, 22:21, billiejoex <gne...@gmail.c omwrote:

Another question: I have to open file for writing ('wb') but I noticed
that both tempfile.mkstem p() and os.fdopen() accept a "mode" argument.
It's not clear *when* do I have to specify such mode. When using
tempfile.mkstem p?

Moreover, what happens if I specify "text" mode when using mkstemp and
"binary" mode when using fdopen?

PS - I think that tempfile.mkstem p docstring should be enhanced to
cover such and other questions (e.g. I find reasonable that every user
using tempfile.mkstem p() should use also os.fdopen() in conjunction
but this isn't mentioned).

As someone already suggested, why don't you use TemporaryFile or
NamedTemporaryF ile and avoid such problems?

--
Gabriel Genellina

[Gerard Flanagan]

On Aug 28, 7:55 pm, billiejoex <gne...@gmail.c omwrote:

Hi there.
I'm trying to generate a brand new file with a unique name by using
tempfile.mkstem p().
In conjunction I used os.fdopen() to get a wrapper around file
properties (write & read methods, and so on...) but 'name' attribute
does not contain the correct file name. Why?

import tempfile, os

class TempFile(object ):

def __init__(self, fd, fname):
self._fileobj = os.fdopen(fd, 'w+b')
self.name = fname

def __getattr__(sel f, attr):
return getattr(self._f ileobj, attr)

def mktempfile(dir= None, suffix='.tmp'):
return TempFile(*tempf ile.mkstemp(dir =dir, suffix=suffix))

[Lawrence D'Oliveiro]

In message <Michael.J.From berger-8FC07C.15483428 082007@localhos t>, Michael
J. Fromberger wrote:

... since os.fdopen() only has access to the file descriptor, it
does not have a convenient way to obtain the file's name.

You can do this under Linux as follows:

os.readlink("/proc/%d/fd/%d" % (os.getpid(), fileno))

[Nick Craig-Wood]

Lawrence D'Oliveiro <ld*@geek-central.gen.new _zealandwrote:

In message <Michael.J.From berger-8FC07C.15483428 082007@localhos t>, Michael
J. Fromberger wrote:

... since os.fdopen() only has access to the file descriptor, it
does not have a convenient way to obtain the file's name.

You can do this under Linux as follows:

os.readlink("/proc/%d/fd/%d" % (os.getpid(), fileno))

A good idea! You can write this slightly more succinctly as

os.readlink("/proc/self/fd/%d" % fileno)

--
Nick Craig-Wood <ni**@craig-wood.com-- http://www.craig-wood.com/nick

[billiejoex]

Gabriel Genellina wrote:

As someone already suggested, why don't you use TemporaryFile or
NamedTemporaryF ile and avoid such problems?

Because I don't want file to be removed after closing.