gh-145417: Do not preserve SELinux context when copying venv scripts by Shrey-N · Pull Request #145454 · python/cpython

Shrey-N · 2026-03-03T08:11:51Z

When copying scripts in venv that don't need variables replaced (like Activate.ps1), shutil.copy2 was incorrectly preserving extended system metadata, including the bin_t SELinux context from the system template directory.

This changes shutil.copy2 to shutil.copy, which aligns the behavior with the fallback else block (which uses shutil.copymode).

This ensures that only the file contents and permission mode are copied, while safely inheriting the SELinux context of the destination project directory.

Issue: python -m venv incorrectly preserves bin_t SELinux context on Activate.ps1 from system templates #145417

python-cla-bot · 2026-03-03T08:11:54Z

All commit authors signed the Contributor License Agreement.

bedevere-app · 2026-03-03T08:11:55Z

Most changes to Python require a NEWS entry. Add one using the blurb_it web app or the blurb command-line tool.

If this change has little impact on Python users, wait for a maintainer to apply the skip news label instead.

hroncok

~~This way, I believe the mode is not copied, and the suggested change needs to be done as well.~~

hroncok · 2026-03-03T08:47:25Z

OK, shutil.copy actually calls shutil.copymode, so the only change required is indeed to change shutil.copy2 to shutil.copy. This works.

However, I was tryign to figure out how to properly test this.

Shrey-N · 2026-03-03T09:31:00Z

Apologies @hroncok I completely missed that you were planning to handle this submission yourself, I am a new contributor, and I was eager to help out and learn about the workflow... Regarding the tests I think your idea of asserting the mtime is a nice approach, since shutil.copy should update the timestamp while copy2 would preserve it.

I am happy to either close this PR, or leave it here if it is a useful starting point. Thank you for your patience I am looking forward to this learning process!

Add a test to verify mtime behavior during script installation.

bedevere-app · 2026-03-03T09:48:46Z

Most changes to Python require a NEWS entry. Add one using the blurb_it web app or the blurb command-line tool.

If this change has little impact on Python users, wait for a maintainer to apply the skip news label instead.

Shrey-N · 2026-03-03T09:52:52Z

I went ahead and added a test case into this PR using the mtime approach, It should cover the verification for metadata prevention now.

Address linting failures in the new test_install_scripts_mtime by removing redundant imports and fixing trailing whitespace in the docstrings.

bedevere-app · 2026-03-03T10:00:04Z

Most changes to Python require a NEWS entry. Add one using the blurb_it web app or the blurb command-line tool.

If this change has little impact on Python users, wait for a maintainer to apply the skip news label instead.

hroncok

I think it might be better to actually use Activate.ps1 in the test. Something like this:

check the mtime of the Activate.ps1 file in the stdlib
if the current time is the same (unlikely, but possible), sleep 1 second
create a virtual environment
assert the Activate.ps1 file in the venv mtime differs from 1.
assert the mode of both Activate.ps1s match (asserting this has not regressed)
assert the Activate.ps1 contents match, so we know we are testing with a proper file (this assert will fail if the file later becomes a template, which serves as a protection against a no longer functional test)

hroncok · 2026-03-03T10:30:39Z

Lib/test/test_venv.py

+        """
+        Test that install_scripts does not preserve mtime when copying scripts.
+        Using mtime serves as a proxy to verify that shutil.copy2 (and thus
+        SELinux bin_t contexts) is not being used during script installation.


It's useful to link the issue here so people reading this know why it matters.

Update the mtime test case based on feedback

bedevere-app · 2026-03-03T10:59:59Z

Most changes to Python require a NEWS entry. Add one using the blurb_it web app or the blurb command-line tool.

If this change has little impact on Python users, wait for a maintainer to apply the skip news label instead.

Shrey-N · 2026-03-03T11:01:32Z

Thank you for the detailed feedback @hroncok ! I have updated the test case to use the Activate.ps1 from the stdlib and followed your plan, including the mode and content assertions. I also added the issue link to the docstring. Let me know if everything looks good now!

bedevere-app · 2026-03-03T11:18:32Z

Most changes to Python require a NEWS entry. Add one using the blurb_it web app or the blurb command-line tool.

If this change has little impact on Python users, wait for a maintainer to apply the skip news label instead.

bedevere-app · 2026-03-03T11:21:58Z

Most changes to Python require a NEWS entry. Add one using the blurb_it web app or the blurb command-line tool.

If this change has little impact on Python users, wait for a maintainer to apply the skip news label instead.

Lib/test/test_venv.py

hroncok · 2026-03-03T11:23:58Z

Lib/test/test_venv.py

+        self.assertNotIn(b'__VENV_PYTHON__', src_data,
+                         "Test assumes Activate.ps1 is a static file, not a template")


Suggestion: Move this before the equality check. It's unlikely the files will be identical when this happens, and this assertion is more meaningful than the previous one.

bedevere-app · 2026-03-03T11:24:18Z

Most changes to Python require a NEWS entry. Add one using the blurb_it web app or the blurb command-line tool.

If this change has little impact on Python users, wait for a maintainer to apply the skip news label instead.

Co-authored-by: Miro Hrončok <miro@hroncok.cz>

bedevere-app · 2026-03-03T11:27:32Z

Most changes to Python require a NEWS entry. Add one using the blurb_it web app or the blurb command-line tool.

If this change has little impact on Python users, wait for a maintainer to apply the skip news label instead.

bedevere-app · 2026-03-03T11:34:05Z

Most changes to Python require a NEWS entry. Add one using the blurb_it web app or the blurb command-line tool.

If this change has little impact on Python users, wait for a maintainer to apply the skip news label instead.

bedevere-app · 2026-03-03T11:37:40Z

Most changes to Python require a NEWS entry. Add one using the blurb_it web app or the blurb command-line tool.

If this change has little impact on Python users, wait for a maintainer to apply the skip news label instead.

Shrey-N · 2026-03-03T11:39:30Z

I fixed the order of the checks so the template protection happens first I think that would make sense if something fails.

I also applied your suggestion for the docstring, I have updated the branch too!

Thanks for the help and the mentorship! Let me know if everything looks good to you. @hroncok

Removed unnecessary blank lines in the test case.

bedevere-app · 2026-03-03T11:41:29Z

Most changes to Python require a NEWS entry. Add one using the blurb_it web app or the blurb command-line tool.

If this change has little impact on Python users, wait for a maintainer to apply the skip news label instead.

Added a temporal check to ensure the source file is not modified during the test. Enhanced assertions to protect against future changes in the Activate.ps1 file's structure.

bedevere-app · 2026-03-03T11:48:37Z

Most changes to Python require a NEWS entry. Add one using the blurb_it web app or the blurb command-line tool.

If this change has little impact on Python users, wait for a maintainer to apply the skip news label instead.

Misc/NEWS.d/next/Library/2026-03-03-11-49-44.gh-issue-145417.m_HxIL.rst

Co-authored-by: Miro Hrončok <miro@hroncok.cz>

Shrey-N · 2026-03-03T12:02:22Z

Accepted! I have updated the branch and everything is passing now.

Thanks again for the help and the mentorship throughout this I really appreciate the guidance! @hroncok

hroncok · 2026-03-03T12:06:14Z

Lib/test/test_venv.py

+        incorrectly copying e.g. SELinux bin_t context.
+        See gh-145417.
+        """
+        import time


Perhaps move this to the toplevel imports. All the other unconditional imports are there, at the beginning of the file.

hroncok · 2026-03-03T12:06:45Z

Thanks. I like the test, and the change fixes the reported problem.

Lib/test/test_venv.py

Shrey-N · 2026-03-03T12:13:58Z

I have moved the import time to the top level as you suggested. Everything should be good now!

Thank you so much for the detailed review and for all the guidance today it means a lot to me! @hroncok

Co-authored-by: Miro Hrončok <miro@hroncok.cz>

Update __init__.py

de24338

Shrey-N requested review from FFY00 and vsajip as code owners March 3, 2026 08:11

bedevere-app bot mentioned this pull request Mar 3, 2026

python -m venv incorrectly preserves bin_t SELinux context on Activate.ps1 from system templates #145417

Open

bedevere-app bot added the awaiting review label Mar 3, 2026

hroncok reviewed Mar 3, 2026

View reviewed changes

Implement test for script installation mtime

ec2958b

Add a test to verify mtime behavior during script installation.

Relint test_venv.py and fix trailing whitespace

1428e75

Address linting failures in the new test_install_scripts_mtime by removing redundant imports and fixing trailing whitespace in the docstrings.

hroncok reviewed Mar 3, 2026

View reviewed changes

Refine venv test to use Activate.ps1 and check mode (pythongh-145417)

8778209

Update the mtime test case based on feedback

Add news entry

52ee5ef

Rename News

eec4e46

hroncok reviewed Mar 3, 2026

View reviewed changes

Delete Misc/NEWS.d/next/Library/gh-issue-145417.shrey.rst

c4d32d5

Apply maintainer's suggestion for docstring clarity

88fae45

Co-authored-by: Miro Hrončok <miro@hroncok.cz>

Move template protection check before content assertion

7dc69f0

Merge branch 'python:main' into main

878d3b8

Clean up blank lines in test_venv.py

75bd937

Removed unnecessary blank lines in the test case.

Enhance test for Activate.ps1 file integrity

a76da3e

Added a temporal check to ensure the source file is not modified during the test. Enhanced assertions to protect against future changes in the Activate.ps1 file's structure.

📜🤖 Added by blurb_it.

89c0c92

hroncok reviewed Mar 3, 2026

View reviewed changes

Misc/NEWS.d/next/Library/2026-03-03-11-49-44.gh-issue-145417.m_HxIL.rst Outdated Show resolved Hide resolved

Applying maintainer's suggestion for news wording

431c4ac

Co-authored-by: Miro Hrončok <miro@hroncok.cz>

hroncok reviewed Mar 3, 2026

View reviewed changes

Shrey-N added 2 commits March 3, 2026 17:41

Change Location of time module

9bcf6db

Merge branch 'main' into main

ead93d7

hroncok reviewed Mar 3, 2026

View reviewed changes

Lib/test/test_venv.py Outdated Show resolved Hide resolved

Reorder imports alphabetically

97652be

Co-authored-by: Miro Hrončok <miro@hroncok.cz>

		self.assertNotIn(b'__VENV_PYTHON__', src_data,
		"Test assumes Activate.ps1 is a static file, not a template")

Uh oh!

Conversation

Shrey-N commented Mar 3, 2026 • edited by bedevere-app bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

python-cla-bot bot commented Mar 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

bedevere-app bot commented Mar 3, 2026

Uh oh!

hroncok left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

hroncok commented Mar 3, 2026

Uh oh!

Shrey-N commented Mar 3, 2026

Uh oh!

bedevere-app bot commented Mar 3, 2026

Uh oh!

Shrey-N commented Mar 3, 2026

Uh oh!

bedevere-app bot commented Mar 3, 2026

Uh oh!

hroncok left a comment

Choose a reason for hiding this comment

Uh oh!

hroncok Mar 3, 2026

Choose a reason for hiding this comment

Uh oh!

bedevere-app bot commented Mar 3, 2026

Uh oh!

Shrey-N commented Mar 3, 2026

Uh oh!

bedevere-app bot commented Mar 3, 2026

Uh oh!

bedevere-app bot commented Mar 3, 2026

Uh oh!

Uh oh!

hroncok Mar 3, 2026

Choose a reason for hiding this comment

Uh oh!

bedevere-app bot commented Mar 3, 2026

Uh oh!

bedevere-app bot commented Mar 3, 2026

Uh oh!

bedevere-app bot commented Mar 3, 2026

Uh oh!

bedevere-app bot commented Mar 3, 2026

Uh oh!

Shrey-N commented Mar 3, 2026

Uh oh!

bedevere-app bot commented Mar 3, 2026

Uh oh!

bedevere-app bot commented Mar 3, 2026

Uh oh!

Uh oh!

Shrey-N commented Mar 3, 2026

Uh oh!

hroncok Mar 3, 2026

Choose a reason for hiding this comment

Uh oh!

hroncok commented Mar 3, 2026

Uh oh!

Uh oh!

Shrey-N commented Mar 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Shrey-N commented Mar 3, 2026 •

edited by bedevere-app bot

Loading

python-cla-bot bot commented Mar 3, 2026 •

edited

Loading

hroncok left a comment •

edited

Loading