From: Scott Lamb <slamb@slamb.org>
Date: Mon, 16 Jul 2007 19:05:33 GMT
Subject: Re: [PATCH] Do _not_ call unlink on a directory
Message-ID: <469BC17D.60806@slamb.org>
In-Reply-To: <vpqd4yss1vo.fsf@bauges.imag.fr>

Matthieu Moy wrote:
> Thomas Glanzmann <sithglan@stud.uni-erlangen.de> writes:
> 
> I believe you still have a race condition if ...
> 
>> -				if (len > state->base_dir_len && state->force && !unlink(buf) && !mkdir(buf, 0777))
>> -					continue;
> 
> ... buf exists here as a file ...
> 
>>  				if (!stat(buf, &st) && S_ISDIR(st.st_mode))
>>  					continue; /* ok */
> 
> ... and became a directory here.
> 
>> +				if (len > state->base_dir_len && state->force && !unlink(buf) && !mkdir(buf, 0777))
>> +					continue;
> 
> But that's quite unlikely to happen. And I have no fix to propose.
> 

If arbitrary other tasks are running, the only way to be absolutely
certain you're not calling unlink() in a directory is to never call
unlink().

SUS describes a safe remove(), but Solaris's implementation contains the
same race:

http://src.opensolaris.org/source/xref/pef/phase_I/usr/src/lib/libc/port/gen/rename.c

so I think this patch is the best that can be done.

Best regards,
Scott

-- 
Scott Lamb <http://www.slamb.org/>