Explain TOCTOU on the top of std::fs, and reference it in functions
#141847
+41
−15
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
rustbot
added
S-waiting-on-review
This comment has been minimized.
This comment has been minimized.
|
oh cool. I was hoping to see this rebased on latest so that #141832 would be included and it "refactored" that documentation. I don't know what's worth changing here without seeing it be a more aggressive cleanup of, at least, the free functions inside std/src/fs.rs |
|
I have referenced this paragraph from all the functions in fs.rs(actually all files in std, including path.rs) that mention TOCTOU, but I don't know if there are any that don't explicitly mention TOCTOU. I will refactor documents in #141832 after I wake up and merge the common parts. |
ChrisDenton
reviewed
Jun 1, 2025
Signed-off-by: xizheyin <xizheyin@smail.nju.edu.cn> Signed-off-by: xizheyin <xizheyin@smail.nju.edu.cn>
xizheyin
commented
Jun 2, 2025
Comment on lines
+2950
to
+2958
| /// See the [module-level TOCTOU explanation](self#time-of-check-to-time-of-use-toctou). | ||
| /// | ||
| /// On most platforms, `fs::remove_dir_all` protects against symlink TOCTOU races by default. | ||
| /// However, on the following platforms, this protection is not provided and the function should | ||
| /// not be used in security-sensitive contexts: | ||
| /// - **Miri**: Even when emulating targets where the underlying implementation will protect against | ||
| /// TOCTOU races, Miri will not do so. | ||
| /// - **Redox OS**: This function does not protect against TOCTOU races, as Redox does not implement | ||
| /// the required platform support to do so. |
There was a problem hiding this comment.
I refactored the contents in #141832. I moved the synbolic TOCTOU race example to the top of fs.rs, and only left which platforms should be taken care of.
Comment on lines
+7
to
+27
| //! | ||
| //! # Time of Check to Time of Use (TOCTOU) | ||
| //! | ||
| //! Many filesystem operations are subject to a race condition known as "Time of Check to Time of Use" | ||
| //! (TOCTOU). This occurs when a program checks a condition (like file existence or permissions) | ||
| //! and then uses the result of that check to make a decision, but the condition may have changed | ||
| //! between the check and the use. | ||
| //! | ||
| //! For example, checking if a file exists and then creating it if it doesn't is vulnerable to | ||
| //! TOCTOU - another process could create the file between your check and creation attempt. | ||
| //! | ||
| //! Another example is with symbolic links: when removing a directory, if another process replaces | ||
| //! the directory with a symbolic link between the check and the removal operation, the removal | ||
| //! might affect the wrong location. This is why operations like [`remove_dir_all`] need to use | ||
| //! atomic operations to prevent such race conditions. | ||
| //! | ||
| //! To avoid TOCTOU issues: | ||
| //! - Be aware that metadata operations (like [`metadata`] or [`symlink_metadata`]) may be affected by | ||
| //! changes made by other processes. | ||
| //! - Use atomic operations when possible (like [`File::create_new`] instead of checking existence then creating). | ||
| //! - Keep file open for the duration of operations. |
There was a problem hiding this comment.
Here,
- first explain what is
TOCTOU - present two examples including
createandremove_dir_all, from simple to complex. - give three notes to try to avoid
TOCTOU.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes #141837
r? @workingjubilee