Issue #18787: spwd.getspnam() now raises a PermissionError if the user

doesn't have privileges.

Doc/library/spwd.rst

@@ -54,6 +54,9 @@ The following functions are defined:
 
    Return the shadow password database entry for the given user name.
 
+   .. versionchanged:: 3.6
+      Raises a :exc:`PermissionError` instead of :exc:`KeyError` if the user
+      doesn't have privileges.
 
 .. function:: getspall()
 

Doc/whatsnew/3.6.rst

@@ -471,6 +471,8 @@ Changes in the Python API
   the exception will stop a single-threaded server. (Contributed by
   Martin Panter in :issue:`23430`.)
 
+* :func:`spwd.getspnam` now raises a :exc:`PermissionError` instead of
+  :exc:`KeyError` if the user doesn't have privileges.
 
 Changes in the C API
 --------------------

Lib/test/test_spwd.py

@@ -56,5 +56,15 @@ class TestSpwdRoot(unittest.TestCase):
             self.assertRaises(TypeError, spwd.getspnam, bytes_name)
 
 
+@unittest.skipUnless(hasattr(os, 'geteuid') and os.geteuid() != 0,
+                     'non-root user required')
+class TestSpwdNonRoot(unittest.TestCase):
+
+    def test_getspnam_exception(self):
+        with self.assertRaises(PermissionError) as cm:
+            spwd.getspnam('bin')
+        self.assertEqual(str(cm.exception), '[Errno 13] Permission denied')
+
+
 if __name__ == "__main__":
     unittest.main()

Misc/NEWS

@@ -226,6 +226,9 @@ Core and Builtins
 Library
 -------
 
+- Issue #18787: spwd.getspnam() now raises a PermissionError if the user
+  doesn't have privileges.
+
 - Issue #26560: Avoid potential ValueError in BaseHandler.start_response.
   Initial patch by Peter Inglesby.
 

Modules/spwdmodule.c

@@ -137,6 +137,9 @@ spwd_getspnam_impl(PyModuleDef *module, PyObject *arg)
     if (PyBytes_AsStringAndSize(bytes, &name, NULL) == -1)
         goto out;
     if ((p = getspnam(name)) == NULL) {
+        if (errno != 0)
+            PyErr_SetFromErrno(PyExc_OSError);
+        else
             PyErr_SetString(PyExc_KeyError, "getspnam(): name not found");
         goto out;
     }