filelock: StrictSoftFileLock creates its claim directories without the lock mode, so another local user with a write bit on them can end a live hold

StrictSoftFileLock and AsyncStrictSoftFileLock apply the caller's mode to the sentinel (the lock file at <path>) and to both claim files (the files whose presence says a process wants or holds the lock). They create the two directories that hold the claims, <path>.filelock and <path>.filelock/claims, with a bare mkdir(). That gives 0o777 filtered through the umask (a per-process mask that removes permission bits from new files and directories) or, under a parent with a default ACL (an access control list on a directory that sets the permissions of entries created inside it), through that ACL.

A hold consists of two claim names in that directory, which has no sticky bit (a directory flag that lets only a file's owner remove it). When the environment leaves another local user (the other user below) a write bit on the directory, that user can unlink the holder's 0600 claims. Three settings do this: umask 000 in a sticky directory such as /tmp, umask 002 with the other user in the directory's group, or a default ACL on the lock's parent that grants the group write (the kernel then ignores the umask). After the unlink, the next contender of the holder's account finds the directory empty and enters. The first holder keeps reporting is_locked == True and later releases with no error. Affected versions: filelock >= 3.30.0 and <= 4.2.0 (finding ANT-2026-AD6SUOON).

Severity

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L, 5.3 (Medium).

AV:L (local): the other user needs an account on the same host. AC:H (high attack complexity): the holder must pass a restrictive mode while its umask or the parent's default ACL leaves the other user a write bit on new directories, and a contender of the holder's account must ask for the lock after the claims are gone. With the common umask 022 and no default ACL the directories are 0755, and the kernel refuses the other user's unlink. PR:L (low privileges): an unprivileged account is enough. UI:N (no user interaction): the holder's processes act on their own.

C:N (no confidentiality impact): the 0600 claim files stay unreadable. I:H (high integrity impact): two holders then write the data the lock protects, and neither learns of the other. A:L (low availability impact): the same write access lets the other user create names in claims, and an empty file named held-v1-<32 zeros>.claim makes the next acquire() raise SoftFileLockProtocolError ("malformed claim record") until someone removes it. Classification from the review: security, conditional on a lax umask or a permissive default ACL. The scanner rated it high (CWE-732).

Scope and preconditions

• The holder passes a restrictive mode such as 0o600. Without one, the umask decides the permissions by documented design (the "File permissions and mode" section of docs/concepts.rst defines mode only for the lock file). Umask 000 with the default mode gives the same two-holder result but is outside this finding.

• The holder's environment leaves the other user a write bit on new directories. The scanner measured three ways, with mode=0o600 and the other user a member of group team:

  lock's parent directory	holder's umask	<path>.filelock and claims/	who can unlink the claims
  1777, like /tmp	000	0777

filelock's checks against another local user hold only when no other user can replace the lock's directory or any of its ancestors. That is the case when each ancestor belongs to the lock's user or root and is either not writable by others or sticky. A user who can rename entries in a non-sticky directory above the lock controls every name below it. No file-based lock can defend against that.

Affected code

At the scanned commit b831496, the bare mkdir() sits in _ensure_protocol_directory. StrictSoftFileLock._acquire calls it for both levels without a mode. It then passes self._open_mode() to the sentinel and, through _attempt_doorway, to both claim files. The doorway (the acquire step that scans existing claims and publishes the caller's own) proceeds when the claim scan is empty. _unlink_owner_path_result counts a missing claim name as removed on release.

Introduced

The bare mkdir() arrived with the claim directories in 650c17c79c54 ("feat(strict): replace shared markers with owner claims", #659, 2026-07-14), first released in 3.30.0. We checked this against the git tags. Every release since 3.30.0 has it.

Mechanism

A process with umask 000 that takes StrictSoftFileLock("/tmp/<dir>/x.lock", mode=0o600) leaves this on disk while it holds the lock, every entry owned by the holder:

0600 x.lock
0777 x.lock.filelock
0777 x.lock.filelock/claims
0600 x.lock.filelock/claims/held-v1-<token>.claim
0600 x.lock.filelock/claims/intent-v1-<token>.claim

Removing a name needs write permission on the directory, and these directories are not sticky. Another local user who cannot read either claim can therefore unlink both. Renaming claims/ away inside the 0777 <path>.filelock has the same effect. For this lock class the directory permissions decide who can end a hold. The sentinel at <path> is permanent and says nothing about who holds. A contender starts its doorway by listing the claim directory and proceeds when it is empty. Once the two names are gone, the next contender publishes its own intent and held claims and enters. The original holder does not notice. is_locked is its own counter, and _release removes its claims by name through _unlink_owner_path_result, which takes FileNotFoundError as "already removed". The first process therefore releases with exit status 0. No force_break(), lifetime or legacy client takes part.

The other user's action is a plain unlink. The right to do it comes from filelock's mkdir, not from anything the application asked for. In the same setting the other user can neither read nor remove the 0600 sentinel in the sticky parent.