Repository navigation
GitHub CodeQL reports for overly permissive file permissions #3267
Description
CodeQL has a Python rule with ID py/overly-permissive-file which flags several chmod/open calls in the node-gyp Python code. I would like to confirm that these operations are intentionally more permissive and safe to suppress.
Flagged locations
| File | Line | Code | CodeQL concern |
|---|---|---|---|
gyp/pylib/gyp/common.py |
561 | os.chmod(tool_path, 0o755) |
World readable |
gyp/pylib/gyp/flock_tool.py |
43 | os.open(lockfile, ..., 0o666) |
World readable/writable |
gyp/pylib/gyp/mac_tool.py |
250 | os.open(lockfile, ..., 0o666) |
World readable/writable |
0o755oncommon.py:561is set because you are unsure whether all build processes are run with the same user0o666on lock files inflock_tool.pyandmac_tool.pyis intentional, with umask expected to restrict actual permissions
Could you confirm these permissions are intentional and by design?
Activity
cclauss commentedon Jan 19, 2026
I am NOT a fan of CodeQL for Python projects...
tibersept commentedon Jan 19, 2026
This is not regarding the source code file permissions. The code itself copies scripts and manages lock files for sync. AFAICS, CodeQL is complaining regarding the permissions of these files created on the machine when executing the tooling.
But I get your point, these seem to be false positives, required behaviour for the execution of the tooling. Can you confirm?