Permission check incorrectly succeed in bubblewrap sandbox

[user202729]

Problem

Assume bwrap (bubblewrap, sandboxing tool) is installed. If I run

bwrap \
  --ro-bind / / \
  --dev-bind /dev /dev \
  --proc /proc \
  --bind /tmp /tmp/ \
  dpsprep -f sample1.djvu sample1-dpsprep-bwrap.pdf

then I get

OSError: [Errno 30] Read-only file system: '/var/tmp/dpsprep/cd52df58'

Cause

This line

        if persistent_tmp.exists() and (persistent_tmp.stat().st_mode & (os.W_OK | os.X_OK)):

only check the permission bits, it does not mean that the folder can indeed be written to.

Suggested fix

Change to:

        if persistent_tmp.exists() and os.access(persistent_tmp, os.W_OK | os.X_OK):

I can confirm that with this fix, the bwrap command above successfully finish and use /tmp/ as the temp dir, while outside bwrap it still uses /var/tmp.

Additional information

To demo the issue (assume bwrap is installed):

bwrap --ro-bind / / --tmpfs /tmp python3 - <<'EOF'
import os
from pathlib import Path
p = Path("/var/tmp")
print(bool(p.stat().st_mode & (os.W_OK | os.X_OK)))
print(os.access(p, os.W_OK | os.X_OK))
EOF

It prints True in the first line and False in the second line.

[v--]

@user202729 Thank you for your report and suggested fix. You can validate the the bugfix/tmp branch (you can view the linked pull request some some comments). As per the installation instructions, this can be done via

uv tool install dpsprep --from git+https://github.com/kcroker/dpsprep@bugfix/tmp

[v--]

I merged the fix along with some other changes. You can test the v2.7.0 tag now (or master).