[mangeshraut712]

Closes #3214.

Problem

test_program_cache_tmp_dir_created_owner_only compares stat.S_IMODE(...) to 0o700. On Linux, a setgid parent (TMPDIR mode 2770) makes mkdir(mode=0o700) inherit S_ISGID, so the observed mode is 0o2700 and the assertion fails even though access is still owner-only.

Change

Mask with & 0o777 before comparing in both places that assert tmp is owner-only. Setgid on a directory only affects the group of new entries; it does not grant access.

Test

mkdir -p /tmp/sg && chmod 2770 /tmp/sg
TMPDIR=/tmp/sg pytest cuda_core/tests/test_program_cache.py -k 'tmp_dir_created_owner_only or preexisting_shared_root'

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	🔄 Running since 2026-10-26T13:47:39.640929Z	3ffeed0	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

Important

Review skipped

Review was skipped as selected files did not have any reviewable changes.

Run configuration

• Source mode: Auto
• Repository: NVIDIA/cuda-python
• Branch: main
• File: .coderabbit.yaml
• Commit: 94625c1
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Enterprise
• Run ID: ef502db9-36ab-429c-9e24-de390898bfe1

Commits

Reviewing files that changed from the base of the PR and between deb38c4 and b564407.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: NVIDIA/cuda-python
• Branch: main
• File: .coderabbit.yaml
• Commit: a2fb804
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Enterprise
• Run ID: 6b0e4187-791c-4caf-991a-126972fcaf9f

Commits

Reviewing files that changed from the base of the PR and between a2fb804 and 3ffeed0.

Files selected for processing: 1

• cuda_core/tests/test_program_cache.py

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 11 remain after this review.

📝 Summary

Summary by CodeRabbit

• Tests
  • Updated permission checks to focus on directory access permissions, avoiding unrelated mode bits affecting test results.

The permission tests now mask directory modes to access bits before checking for owner-only permissions. This prevents an inherited setgid bit from causing the assertions to fail.

Changes: Permission tests

Layer / File(s)	Summary
Mask mode bits in permission assertions cuda_core/tests/test_program_cache.py	The temporary-directory and shared-root checks mask directory modes with 0o777 before asserting owner-only access. The first test’s docstring notes that inherited setgid does not affect the check.

Assessment against linked issues

Objective	Addressed	Explanation
Check that the temporary directory is owner-only even when its parent has the setgid bit [#3214]	✅

Possibly related issues

Suggested labels: bug, test, cuda.core

Suggested reviewers: rparolin

Priority: Low

Change: Bug fix · Severity of issue fixed: Low

Merge Risk: Minimal · previous review 3ffee

This test-only change addresses the setgid-parent failure without altering production behavior.

Finishing Touches: 💡 1

🛠️ Fix failing CI checks: 💡

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[Andy-Jost]

/ok to test b564407

[github-actions]

Doc Preview CI
Preview removed because the pull request was closed or merged.

[Andy-Jost]

Thanks, this is the right fix. The cache creates tmp/ with mkdir(mode=0o700) and never chmods it, so under a setgid TMPDIR the directory inherits S_ISGID and the old S_IMODE(...) == 0o700 assertion saw 0o2700. Masking with & 0o777 drops only the special bits and keeps every access bit, so a group- or world-accessible tmp/ still fails the test; I confirmed both the old failure and the new pass against the real code under a mode-2770 parent, and the loosened modes 0o750, 0o755, and 0o770 are still caught.

One nit, not a blocker: the second hunk, in test_program_cache_preexisting_shared_root_used_as_is, is not needed for #3214. That test calls os.chmod(root, 0o777) first, which clears the setgid bit on root, so tmp/ never inherits it there. Keeping the mask for symmetry is fine; a half-sentence in that test's docstring saying so would spare the next reader the question.