_virtual_env: handle PermissionError (#737)

* _virtual_env: handle PermissionError

See pypa/pip-audit#732

Signed-off-by: William Woodruff <william@trailofbits.com>

* _virtual_env: move the PermissionError around

Signed-off-by: William Woodruff <william@trailofbits.com>

* docstring coverage, add test

Signed-off-by: William Woodruff <william@trailofbits.com>

* CHANGELOG: record changes

Signed-off-by: William Woodruff <william@trailofbits.com>

---------

Signed-off-by: William Woodruff <william@trailofbits.com>

CHANGELOG.md

@@ -8,6 +8,12 @@ All versions prior to 0.0.9 are untracked.
 
 ## [Unreleased]
 
+### Fixed
+
+* Improved the error returned to users when their default temporary
+  directory lacks execute permissions
+  ([#737](https://github.com/pypa/pip-audit/pull/737))
+
 ## [2.7.0]
 
 ### Added

pip_audit/_virtual_env.py

@@ -7,7 +7,8 @@
 import json
 import logging
 import venv
-from tempfile import NamedTemporaryFile, TemporaryDirectory
+from os import PathLike
+from tempfile import NamedTemporaryFile, TemporaryDirectory, gettempdir
 from types import SimpleNamespace
 from typing import Iterator
 
@@ -70,6 +71,32 @@ def __init__(
         self._packages: list[tuple[str, Version]] | None = None
         self._state = state
 
+    def create(self, env_dir: str | bytes | PathLike[str] | PathLike[bytes]) -> None:
+        """
+        Creates the virtual environment.
+        """
+
+        try:
+            return super().create(env_dir)
+        except PermissionError:
+            # `venv` uses a subprocess internally to bootstrap pip, but
+            # some Linux distributions choose to mark the system temporary
+            # directory as `noexec`. Apart from having only nominal security
+            # benefits, this completely breaks our ability to execute from
+            # within the temporary virtualenv.
+            #
+            # We may be able to hack around this in the future, but doing so
+            # isn't straightforward or reliable. So we bail for now.
+            #
+            # See: https://github.com/pypa/pip-audit/issues/732
+            base_tmpdir = gettempdir()
+            raise VirtualEnvError(
+                f"Couldn't execute in a temporary directory under {base_tmpdir}. "
+                "This is sometimes caused by a noexec mount flag or other setting. "
+                "Consider changing this setting or explicitly specifying a different "
+                "temporary directory via the TMPDIR environment variable."
+            )
+
     def post_setup(self, context: SimpleNamespace) -> None:
         """
         Install the custom package and populate the list of installed packages.

test/test_virtual_env.py

@@ -1,5 +1,7 @@
+import subprocess
 from tempfile import TemporaryDirectory
 
+import pretend
 import pytest
 from packaging.version import Version
 
@@ -58,3 +60,17 @@ def run_mock(args, **kwargs):
         ve = VirtualEnv(["flask==2.0.1"])
         with pytest.raises(VirtualEnvError):
             ve.create(ve_dir)
+
+
+def test_virtual_env_failed_permission_error(monkeypatch):
+    """
+    This is a mocked test for GH#732, which is really caused by a user's
+    default `$TMPDIR` having the `noexec` flag set. We have no easy way
+    to unit test this, so we hopefully replicate its effect with a monkeypatch.
+    """
+
+    monkeypatch.setattr(subprocess, "run", pretend.raiser(PermissionError))
+    with TemporaryDirectory() as ve_dir:
+        ve = VirtualEnv(["flask==2.0.1"])
+        with pytest.raises(VirtualEnvError, match=r"^Couldn't execute in a temporary directory .+"):
+            ve.create(ve_dir)