pip: inconsistent permissions issues

Question

When installing a package via sudo pip-python (CentOS 6 package: python-pip-0.8-1.el6.noarch), I sometimes get permission issues with the installed packages being readable only by root.

Re-installing again one or two times usually fixes the problem. Has anyone experienced this? Or can anyone suggest any troubleshooting steps to nail down the cause?

Solution

When you run a command using sudo, it will preserve the users umask. pip just installs files, it doesn't change access rights, so you'll end up with the files having the access rights set conforming to the current user's umask, which may be owner-readable only (0077) and therefore readable by root only.

That means you can set umask to something sensible like umask 0022 before running sudo pip install. Or use sudo su to open a root shell with default settings and then pip install.

Comments

[Belmin Fernandez]

Initially, when one of our staff members reported this, I thought the same thing. However, it has now happened to me a couple of times where it sets restrictive permissions first but then, when I run it again without changing anything, it works fine.

[mata]

Hm, that really seems strange, specially the 'without changin anything' part. I've only seen this problem when running pip through sudo, now I always run pip from the root shell with a proper umask, an it hasn't happened to me since. Don't know what's going on here...

[mabraham]

You can also run sudo bash, then umask 0022, then pip install

[artejera]

Great tip, thanks. After installation I changed permissions: cd /usr/local/lib/python2.7/site-packages; chmod -R o+rw * and everything worked fine

[mata]

@artejera that's a very bad idea as it opens a big security vulnerability. Now anybody can place or modify files there, and compromise any other use of these packages. Nothing below /usr should be world writeable!