Relax netrc security check

[grepwood]

Feature or enhancement

Proposal:

I'd like to spin up k8s pods that use the netrc for authentication to various endpoints, since the requests module supports it implicitly.

However, still as of now, k8s secrets can't be mounted with a specified user, only specified group. This means that when our ~/.netrc is owned by root, belongs to the same group as our user and still can be read because its ACLs are 640, the following code will still fail:

import netrc
x = netrc.netrc()

I think that the security check should permit the following scenarios:

1. We are user foo, the rights for ~/.netrc are -rw------- at the most, and the ~/.netrc belongs to user foo and whatever group. It doesn't matter, we are the sole owner of the file.
2. We are user foo who belongs to group bar, the rights for the ~/.netrc are -rw-r----- at the most, and the ~/.netrc belongs to user root and group bar. As members of the same group, we are clearly allowed to use it.

Has this already been discussed elsewhere?

No response given

Links to previous discussion of this feature:

No response

[picnixz]

I believe this is documented and deliberate:

If no argument is specified on a POSIX system, the presence of passwords in the .netrc file will raise a NetrcParseError if the file ownership or permissions are insecure (owned by a user other than the user running the process, or accessible for read or write by any other user). This implements security behavior equivalent to that of ftp and other programs that use .netrc. Such security checks are not available on platforms that do not support os.getuid().

and thus fall outside what we want to support in this case.

[grepwood]

Then what are k8s users supposed to do then?

[picnixz]

Pass an explicit file. Using the default-detected netrc file will trigger the security check but if you specify the netrc file to use, those security checks are by-passed. As documented, we just mimic others programs' behavior.

[grepwood]

Thanks, got it. Until k8s starts supporting UIDs in mounts, this will have to suffice:

import netrc
import pathlib

global_netrc_path = str(pathlib.Path.home() / '.netrc')
global_netrc = netrc.netrc(file=global_netrc_path)

Closing the issue. Thank you very much :)