gh-116622: Don't expose FICLONE ioctl on Android#122522
Merged
Uh oh!
There was an error while loading. Please reload this page.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Although this ioctl exists in the system headers, it's blocked by SELinux with a message like this:
type=1400 audit(0.0:18729): avc: denied{ioctl } for path=2F646174612F646174612F6F72672E707974686F6E2E746573746265642F63616368652F746573745F707974686F6E5F776F726B65725F36373532C3A62F40746573745F363735325F746D70C3A62F636F707941 dev="dm-39" ino=369303 ioctlcmd=0x9409 scontext=u:r:untrusted_app:s0:c225,c256,c512,c768 tcontext=u:object_r:app_data_file:s0:c225,c256,c512,c768 tclass=file permissive=0 app=org.python.testbedOn Python 3.14 this breaks the test for
Path.copy, which was added in #119058:On Python 3.13 I don't think Python ever uses this ioctl itself, but it's still worth backporting this PR for the benefit of user code.