Confusing set of OS-related exceptions

OS-related (or system call-related) exceptions are currently a diversity of classes, arranged in the following sub-hierarchies:

+-- EnvironmentError
    +-- IOError
        +-- io.BlockingIOError
        +-- io.UnsupportedOperation (also inherits from ValueError)
        +-- socket.error
            +-- socket.gaierror
            +-- socket.herror
            +-- socket.timeout
    +-- OSError
        +-- VMSError
        +-- WindowsError
    +-- mmap.error
+-- select.error

While some of these distinctions can be explained by implementation considerations, they are often not very logical at a higher level. The line separating OSError and IOError, for example, is often blurry. Consider the following:

>>> os.remove("fff")
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
OSError: [Errno 2] No such file or directory: 'fff'
>>> open("fff")
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
IOError: [Errno 2] No such file or directory: 'fff'

The same error condition (a non-existing file) gets cast as two different exceptions depending on which library function was called. The reason for this is that the os module exclusively raises OSError (or its subclass WindowsError) while the io module mostly raises IOError. However, the user is interested in the nature of the error, not in which part of the interpreter it comes from (since the latter is obvious from reading the traceback message or application source code).

In fact, it is hard to think of any situation where OSError should be caught but not IOError, or the reverse.

A further proof of the ambiguity of this segmentation is that the standard library itself sometimes has problems deciding. For example, in the select module, similar failures will raise select.error, OSError or IOError depending on whether you are using select(), a poll object, a kqueue object, or an epoll object. This makes user code uselessly complicated since it has to be prepared to catch various exception types, depending on which exact implementation of a single primitive it chooses to use at runtime.

As for WindowsError, it seems to be a pointless distinction. First, it only exists on Windows systems, which requires tedious compatibility code in cross-platform applications (such code can be found in Lib/shutil.py). Second, it inherits from OSError and is raised for similar errors as OSError is raised for on other systems. Third, the user wanting access to low-level exception specifics has to examine the errno or winerror attribute anyway.

Lack of fine-grained exceptions

The current variety of OS-related exceptions doesn’t allow the user to filter easily for the desired kinds of failures. As an example, consider the task of deleting a file if it exists. The Look Before You Leap (LBYL) idiom suffers from an obvious race condition:

if os.path.exists(filename):
    os.remove(filename)

If a file named as filename is created by another thread or process between the calls to os.path.exists and os.remove, it won’t be deleted. This can produce bugs in the application, or even security issues.

Therefore, the solution is to try to remove the file, and ignore the error if the file doesn’t exist (an idiom known as Easier to Ask Forgiveness than to get Permission, or EAFP). Careful code will read like the following (which works under both POSIX and Windows systems):

try:
    os.remove(filename)
except OSError as e:
    if e.errno != errno.ENOENT:
        raise

or even:

try:
    os.remove(filename)
except EnvironmentError as e:
    if e.errno != errno.ENOENT:
        raise

This is a lot more to type, and also forces the user to remember the various cryptic mnemonics from the errno module. It imposes an additional cognitive burden and gets tiresome rather quickly. Consequently, many programmers will instead write the following code, which silences exceptions too broadly:

try:
    os.remove(filename)
except OSError:
    pass

os.remove can raise an OSError not only when the file doesn’t exist, but in other possible situations (for example, the filename points to a directory, or the current process doesn’t have permission to remove the file), which all indicate bugs in the application logic and therefore shouldn’t be silenced. What the programmer would like to write instead is something such as:

try:
    os.remove(filename)
except FileNotFoundError:
    pass

Justification

Not only does this first step present the user a simpler landscape as explained in the rationale section, but it also allows for a better and more complete resolution of Step 2 (see Prerequisite).

The rationale for keeping OSError as the official name for generic OS-related exceptions is that it, precisely, is more generic than IOError. EnvironmentError is more tedious to type and also much lesser-known.

The survey in Appendix B shows that IOError is the dominant error today in the standard library. As for third-party Python code, Google Code Search shows IOError being ten times more popular than EnvironmentError in user code, and three times more popular than OSError 3. However, with no intention to deprecate IOError in the middle term, the lesser popularity of OSError is not a problem.

Exception attributes

Since WindowsError is coalesced into OSError, the latter gains a winerror attribute under Windows. It is set to None under situations where it is not meaningful, as is already the case with the errno, filename and strerror attributes (for example when OSError is raised directly by Python code).

Deprecation of names

The following paragraphs outline a possible deprecation strategy for old exception names. However, it has been decided to keep them as aliases for the time being. This decision could be revised in time for Python 4.0.

Prerequisite

Step 1 is a loose prerequisite for this.

Prerequisite, because some errnos can currently be attached to different exception classes: for example, ENOENT can be attached to both OSError and IOError, depending on the context. If we don’t want to break useful compatibility, we can’t make an except OSError (or IOError) fail to match an exception where it would succeed today.

Loose, because we could decide for a partial resolution of step 2 if existing exception classes are not coalesced: for example, ENOENT could raise a hypothetical FileNotFoundError where an IOError was previously raised, but continue to raise OSError otherwise.

The dependency on step 1 could be totally removed if the new subclasses used multiple inheritance to match with all of the existing superclasses (or, at least, OSError and IOError, which are arguable the most prevalent ones). It would, however, make the hierarchy more complicated and therefore harder to grasp for the user.

New exception classes

The following tentative list of subclasses, along with a description and the list of errnos mapped to them, is submitted to discussion:

• FileExistsError: trying to create a file or directory which already exists (EEXIST)
• FileNotFoundError: for all circumstances where a file and directory is requested but doesn’t exist (ENOENT)
• IsADirectoryError: file-level operation (open(), os.remove()…) requested on a directory (EISDIR)
• NotADirectoryError: directory-level operation requested on something else (ENOTDIR)
• PermissionError: trying to run an operation without the adequate access rights - for example filesystem permissions (EACCES, EPERM)
• BlockingIOError: an operation would block on an object (e.g. socket) set for non-blocking operation (EAGAIN, EALREADY, EWOULDBLOCK, EINPROGRESS); this is the existing io.BlockingIOError with an extended role
• BrokenPipeError: trying to write on a pipe while the other end has been closed, or trying to write on a socket which has been shutdown for writing (EPIPE, ESHUTDOWN)
• InterruptedError: a system call was interrupted by an incoming signal (EINTR)
• ConnectionAbortedError: connection attempt aborted by peer (ECONNABORTED)
• ConnectionRefusedError: connection reset by peer (ECONNREFUSED)
• ConnectionResetError: connection reset by peer (ECONNRESET)
• TimeoutError: connection timed out (ETIMEDOUT); this can be re-cast as a generic timeout exception, replacing socket.timeout and also useful for other types of timeout (for example in Lock.acquire())
• ChildProcessError: operation on a child process failed (ECHILD); this is raised mainly by the wait() family of functions.
• ProcessLookupError: the given process (as identified by, e.g., its process id) doesn’t exist (ESRCH).

In addition, the following exception class is proposed for inclusion:

• ConnectionError: a base class for ConnectionAbortedError, ConnectionRefusedError and ConnectionResetError

The following drawing tries to sum up the proposed additions, along with the corresponding errno values (where applicable). The root of the sub-hierarchy (OSError, assuming Step 1 is accepted in full) is not shown:

+-- BlockingIOError        EAGAIN, EALREADY, EWOULDBLOCK, EINPROGRESS
+-- ChildProcessError                                          ECHILD
+-- ConnectionError
    +-- BrokenPipeError                              EPIPE, ESHUTDOWN
    +-- ConnectionAbortedError                           ECONNABORTED
    +-- ConnectionRefusedError                           ECONNREFUSED
    +-- ConnectionResetError                               ECONNRESET
+-- FileExistsError                                            EEXIST
+-- FileNotFoundError                                          ENOENT
+-- InterruptedError                                            EINTR
+-- IsADirectoryError                                          EISDIR
+-- NotADirectoryError                                        ENOTDIR
+-- PermissionError                                     EACCES, EPERM
+-- ProcessLookupError                                          ESRCH
+-- TimeoutError                                            ETIMEDOUT

Naming

Various naming controversies can arise. One of them is whether all exception class names should end in “Error”. In favour is consistency with the rest of the exception hierarchy, against is concision (especially with long names such as ConnectionAbortedError).

Exception attributes

In order to preserve useful compatibility, these subclasses should still set adequate values for the various exception attributes defined on the superclass (for example errno, filename, and optionally winerror).

Implementation

Since it is proposed that the subclasses are raised based purely on the value of errno, little or no changes should be required in extension modules (either standard or third-party).

The first possibility is to adapt the PyErr_SetFromErrno() family of functions (PyErr_SetFromWindowsErr() under Windows) to raise the appropriate OSError subclass. This wouldn’t cover, however, Python code raising OSError directly, using the following idiom (seen in Lib/tempfile.py):

raise IOError(_errno.EEXIST, "No usable temporary file name found")

A second possibility, suggested by Marc-Andre Lemburg, is to adapt OSError.__new__ to instantiate the appropriate subclass. This has the benefit of also covering Python code such as the above.

Namespace pollution

Making the exception hierarchy finer-grained makes the root (or builtins) namespace larger. This is to be moderated, however, as:

• only a handful of additional classes are proposed;
• while standard exception types live in the root namespace, they are visually distinguished by the fact that they use the CamelCase convention, while almost all other builtins use lowercase naming (except True, False, None, Ellipsis and NotImplemented)

An alternative would be to provide a separate module containing the finer-grained exceptions, but that would defeat the purpose of encouraging careful code over careless code, since the user would first have to import the new module instead of using names already accessible.

Pattern matching

Another possibility would be to introduce an advanced pattern matching syntax when catching exceptions. For example:

try:
    os.remove(filename)
except OSError as e if e.errno == errno.ENOENT:
    pass

Several problems with this proposal:

• it introduces new syntax, which is perceived by the author to be a heavier change compared to reworking the exception hierarchy
• it doesn’t decrease typing effort significantly
• it doesn’t relieve the programmer from the burden of having to remember errno mnemonics

Common errnos with OSError

• EBADF: bad file descriptor (usually means the file descriptor was closed)
• EEXIST: file or directory exists
• EINTR: interrupted function call
• EISDIR: is a directory
• ENOTDIR: not a directory
• ENOENT: no such file or directory
• EOPNOTSUPP: operation not supported on socket (possible confusion with the existing io.UnsupportedOperation)
• EPERM: operation not permitted (when using e.g. os.setuid())

Common errnos with IOError

• EACCES: permission denied (for filesystem operations)
• EBADF: bad file descriptor (with select.epoll); read operation on a write-only GzipFile, or vice-versa
• EBUSY: device or resource busy
• EISDIR: is a directory (when trying to open())
• ENODEV: no such device
• ENOENT: no such file or directory (when trying to open())
• ETIMEDOUT: connection timed out

Common errnos with socket.error

All these errors may also be associated with a plain IOError, for example when calling read() on a socket’s file descriptor.

• EAGAIN: resource temporarily unavailable (during a non-blocking socket call except connect())
• EALREADY: connection already in progress (during a non-blocking connect())
• EINPROGRESS: operation in progress (during a non-blocking connect())
• EINTR: interrupted function call
• EISCONN: the socket is connected
• ECONNABORTED: connection aborted by peer (during an accept() call)
• ECONNREFUSED: connection refused by peer
• ECONNRESET: connection reset by peer
• ENOTCONN: socket not connected
• ESHUTDOWN: cannot send after transport endpoint shutdown
• EWOULDBLOCK: same reasons as EAGAIN

Common errnos with select.error

• EINTR: interrupted function call

About VMSError

VMSError is completely unused by the interpreter core and the standard library. It was added as part of the OpenVMS patches submitted in 2002 by Jean-François Piéronne 4; the motivation for including VMSError was that it could be raised by third-party packages.

Interpreter core

Handling of PYTHONSTARTUP raises IOError (but the error gets discarded):

$ PYTHONSTARTUP=foox ./python
Python 3.2a0 (py3k:82920M, Jul 16 2010, 22:53:23)
[GCC 4.4.3] on linux2
Type "help", "copyright", "credits" or "license" for more information.
Could not open PYTHONSTARTUP
IOError: [Errno 2] No such file or directory: 'foox'

PyObject_Print() raises IOError when ferror() signals an error on the FILE * parameter (which, in the source tree, is always either stdout or stderr).

Unicode encoding and decoding using the mbcs encoding can raise WindowsError for some error conditions.

Standard library

>>> bz2.BZ2File("foox", "rb")
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
IOError: [Errno 2] No such file or directory
>>> bz2.BZ2File("LICENSE", "rb").read()
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
IOError: invalid data stream
>>> bz2.BZ2File("/tmp/zzz.bz2", "wb").read()
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
IOError: file is not ready for reading

>>> dbm.gnu.open("foox")
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
_gdbm.error: [Errno 2] No such file or directory

>>> imp.load_source("foo", "foo", 123)
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
IOError: [Errno 9] Bad file descriptor

>>> open("Python/", "r")
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
IOError: [Errno 21] Is a directory: 'Python/'

>>> open("LICENSE").write("bar")
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
IOError: not writable
>>> io.StringIO().fileno()
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
io.UnsupportedOperation: fileno
>>> open("LICENSE").seek(1, 1)
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
IOError: can't do nonzero cur-relative seeks

>>> f = open("LICENSE")
>>> os.close(f.fileno())
>>> f.read()
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
IOError: [Errno 9] Bad file descriptor

>>> f = open("LICENSE")
>>> next(f)
'A. HISTORY OF THE SOFTWARE\n'
>>> f.tell()
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
IOError: telling position disabled by next() call

>>> mmap.mmap(123, 10)
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
mmap.error: [Errno 9] Bad file descriptor
>>> mmap.mmap(os.open("/tmp", os.O_RDONLY), 10)
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
mmap.error: [Errno 13] Permission denied

>>> fd = os.open("LICENSE", os.O_RDONLY)
>>> m = mmap.mmap(fd, 16384)
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
WindowsError: [Error 5] Accès refusé
>>> sys.last_value.errno
13
>>> errno.errorcode[13]
'EACCES'

>>> m = mmap.mmap(-1, 4096)
>>> m.resize(16384)
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
WindowsError: [Error 87] Paramètre incorrect
>>> sys.last_value.errno
22
>>> errno.errorcode[22]
'EINVAL'

>>> ossaudiodev.open("foo", "r")
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
IOError: [Errno 2] No such file or directory: 'foo'

>>> readline.read_history_file("foo")
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
IOError: [Errno 2] No such file or directory
>>> readline.read_init_file("foo")
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
IOError: [Errno 2] No such file or directory
>>> readline.write_history_file("/dev/nonexistent")
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
IOError: [Errno 13] Permission denied

>>> signal.alarm(1); select.select([], [], [])
0
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
select.error: (4, 'Interrupted system call')
>>> e = sys.last_value
>>> e
error(4, 'Interrupted system call')
>>> e.errno == errno.EINTR
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
AttributeError: 'error' object has no attribute 'errno'
>>> e.args[0] == errno.EINTR
True