GitHub CodeQL reports for overly permissive file permissions

[tibersept]

CodeQL has a Python rule with ID py/overly-permissive-file which flags several chmod/open calls in the node-gyp Python code. I would like to confirm that these operations are intentionally more permissive and safe to suppress.

Flagged locations

File	Line	Code	CodeQL concern
gyp/pylib/gyp/common.py	561	os.chmod(tool_path, 0o755)	World readable
gyp/pylib/gyp/flock_tool.py	43	os.open(lockfile, ..., 0o666)	World readable/writable
gyp/pylib/gyp/mac_tool.py	250	os.open(lockfile, ..., 0o666)	World readable/writable

• 0o755 on common.py:561 is set because you are unsure whether all build processes are run with the same user
• 0o666 on lock files in flock_tool.py and mac_tool.py is intentional, with umask expected to restrict actual permissions

Could you confirm these permissions are intentional and by design?

[cclauss]

Recommendation: Restrict the file permissions of files to prevent any but the owner being able to read or write to that file

I am NOT a fan of CodeQL for Python projects...

• Does it really make sense to block read permissions on source code in open source projects?

[tibersept]

This is not regarding the source code file permissions. The code itself copies scripts and manages lock files for sync. AFAICS, CodeQL is complaining regarding the permissions of these files created on the machine when executing the tooling.

But I get your point, these seem to be false positives, required behaviour for the execution of the tooling. Can you confirm?