Skip to content

Fix TOCTOU race condition in acquire_lock for PROJECTS_ROOT#16550

Open
simon-mags wants to merge 1 commit into
ansible:develfrom
simon-mags:fix/acquire-lock-toctou-projects-root
Open

Fix TOCTOU race condition in acquire_lock for PROJECTS_ROOT#16550
simon-mags wants to merge 1 commit into
ansible:develfrom
simon-mags:fix/acquire-lock-toctou-projects-root

Conversation

@simon-mags

@simon-mags simon-mags commented Jul 20, 2026 •
edited by coderabbitai Bot
Loading

Copy link
Copy Markdown
SUMMARY

Fix a TOCTOU (time-of-check/time-of-use) race condition in acquire_lock() that causes FileExistsError on PROJECTS_ROOT when multiple task replicas start jobs concurrently.

The non-atomic check-then-create pattern:

if not os.path.exists(settings.PROJECTS_ROOT):
    os.mkdir(settings.PROJECTS_ROOT)

is replaced with the atomic, idempotent:

os.makedirs(settings.PROJECTS_ROOT, exist_ok=True)

With exist_ok=True, concurrent replicas that race on the directory creation will all succeed rather than all but the first raising FileExistsError.

ISSUE TYPE
  • Bug Fix
COMPONENT NAME
  • awx/main/tasks/jobs.py
ADDITIONAL INFORMATION

Fixes #16447

A regression test test_acquire_lock_projects_root_race_condition has been added to awx/main/tests/unit/test_tasks.py to confirm os.makedirs is called with exist_ok=True.

Summary by CodeRabbit

  • Bug Fixes

    • Improved project update lock handling to avoid failures when the projects directory already exists.
    • Project updates now reliably proceed when the directory is created concurrently or is already present.

  • Tests

    • Added regression coverage for concurrent project directory creation scenarios.

@simon-mags @claude
Fix TOCTOU race condition in acquire_lock for PROJECTS_ROOT
b9c71ce 
Replace the non-atomic check-then-mkdir pattern with os.makedirs(exist_ok=True)
so concurrent task replicas no longer race on directory creation and raise
FileExistsError when multiple jobs start simultaneously.

Fixes ansible#16447

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@coderabbitai

coderabbitai Bot commented Jul 20, 2026 •
edited
Loading

Copy link
Copy Markdown

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Enterprise

Run ID: e381388d-abd3-49a3-8376-5e99639b8a0f

📥 Commits

Reviewing files that changed from the base of the PR and between ea14ee1 and b9c71ce.

📒 Files selected for processing (2)
  • awx/main/tasks/jobs.py
  • awx/main/tests/unit/test_tasks.py
📝 Walkthrough

Walkthrough

acquire_lock() now creates PROJECTS_ROOT with os.makedirs(..., exist_ok=True). A regression test verifies the idempotent directory creation behavior during lock acquisition.

Changes

Project root lock initialization

Layer / File(s) Summary
Atomic project root creation and regression coverage
awx/main/tasks/jobs.py, awx/main/tests/unit/test_tasks.py		 BaseTask.acquire_lock() replaces the check-then-create sequence with os.makedirs(..., exist_ok=True), and a unit test verifies the call while mocking filesystem locking operations.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: djyasin

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly describes the main change: fixing the TOCTOU race in acquire_lock for PROJECTS_ROOT.
Linked Issues check ✅ Passed The code and regression test implement the linked fix by replacing the check-then-act mkdir with os.makedirs(..., exist_ok=True).
Out of Scope Changes check ✅ Passed The PR is narrowly scoped to the race fix and a regression test, with no unrelated code changes.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@simon-mags simon-mags mentioned this pull request Jul 20, 2026
Open
11 tasks
@simon-mags
simon-mags marked this pull request as ready for review July 20, 2026 02:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

community component:api

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

acquire_lock: TOCTOU race condition on PROJECTS_ROOT with multiple task replicas

1 participant

@simon-mags