Explain `TOCTOU` on the top of `std::fs`, and reference it in functions #141847

xizheyin · 2025-06-01T07:08:32Z

workingjubilee · 2025-06-01T15:41:15Z

oh cool.

I was hoping to see this rebased on latest so that #141832 would be included and it "refactored" that documentation. I don't know what's worth changing here without seeing it be a more aggressive cleanup of, at least, the free functions inside std/src/fs.rs

xizheyin · 2025-06-01T19:18:29Z

I have referenced this paragraph from all the functions in fs.rs(actually all files in std, including path.rs) that mention TOCTOU, but I don't know if there are any that don't explicitly mention TOCTOU. I will refactor documents in #141832 after I wake up and merge the common parts.

library/std/src/fs.rs

Signed-off-by: xizheyin <xizheyin@smail.nju.edu.cn> Signed-off-by: xizheyin <xizheyin@smail.nju.edu.cn>

xizheyin · 2025-06-02T09:50:48Z

library/std/src/fs.rs

+/// See the [module-level TOCTOU explanation](self#time-of-check-to-time-of-use-toctou).
+///
+/// On most platforms, `fs::remove_dir_all` protects against symlink TOCTOU races by default.
+/// However, on the following platforms, this protection is not provided and the function should
+/// not be used in security-sensitive contexts:
+/// - **Miri**: Even when emulating targets where the underlying implementation will protect against
+///   TOCTOU races, Miri will not do so.
+/// - **Redox OS**: This function does not protect against TOCTOU races, as Redox does not implement
+///   the required platform support to do so.


I refactored the contents in #141832. I moved the synbolic TOCTOU race example to the top of fs.rs, and only left which platforms should be taken care of.

xizheyin · 2025-06-02T09:58:19Z

library/std/src/fs.rs

+//!
+//! # Time of Check to Time of Use (TOCTOU)
+//!
+//! Many filesystem operations are subject to a race condition known as "Time of Check to Time of Use"
+//! (TOCTOU). This occurs when a program checks a condition (like file existence or permissions)
+//! and then uses the result of that check to make a decision, but the condition may have changed
+//! between the check and the use.
+//!
+//! For example, checking if a file exists and then creating it if it doesn't is vulnerable to
+//! TOCTOU - another process could create the file between your check and creation attempt.
+//!
+//! Another example is with symbolic links: when removing a directory, if another process replaces
+//! the directory with a symbolic link between the check and the removal operation, the removal
+//! might affect the wrong location. This is why operations like [`remove_dir_all`] need to use
+//! atomic operations to prevent such race conditions.
+//!
+//! To avoid TOCTOU issues:
+//! - Be aware that metadata operations (like [`metadata`] or [`symlink_metadata`]) may be affected by
+//! changes made by other processes.
+//! - Use atomic operations when possible (like [`File::create_new`] instead of checking existence then creating).
+//! - Keep file open for the duration of operations.


Here,

first explain what is TOCTOU

present two examples including create and remove_dir_all, from simple to complex.

give three notes to try to avoid TOCTOU.

workingjubilee · 2025-06-11T07:05:50Z

Hm. I know I filed the issues but I wasn't really expecting to get two PRs immediately and r?'d on them, I kinda expected them to hit the rotation, and this is a slightly more tricky PR to judge when biased by being the reporter. So I'm going to pass them onto the rotation, sorry! ^^;

r? libs

rustbot · 2025-06-11T07:05:54Z

Failed to set assignee to 'd: invalid assignee

Note: Only org members with at least the repository "read" role, users with write permissions, or people who have commented on the PR may be assigned.

xizheyin · 2025-06-29T08:32:38Z

r? libs

jhpratt · 2025-07-01T23:33:41Z

@bors r+ rollup

bors · 2025-07-01T23:33:44Z

📌 Commit e95751a has been approved by jhpratt

It is now in the queue for this repository.

Explain `TOCTOU` on the top of `std::fs`, and reference it in functions Fixes rust-lang#141837 r? `@workingjubilee`

Rollup of 12 pull requests Successful merges: - #141829 (Specialize sleep_until implementation for unix (except mac)) - #141847 (Explain `TOCTOU` on the top of `std::fs`, and reference it in functions) - #142138 (Add `Vec::into_chunks`) - #142321 (Expose elf abi on ppc64 targets) - #142568 (Use the .drectve section for exporting symbols from dlls on Windows) - #142886 (ci: aarch64-gnu: Stop skipping `panic_abort_doc_tests`) - #143038 (avoid suggesting traits from private dependencies) - #143194 (fix bitcast of single-element SIMD vectors) - #143206 (Align attr fixes) - #143258 (Don't recompute `DisambiguatorState` for every RPITIT in trait definition) - #143260 (Use the correct export kind for __rust_alloc_error_handler_should_panic) - #143274 (ci: support optional jobs) r? `@ghost` `@rustbot` modify labels: rollup

Explain `TOCTOU` on the top of `std::fs`, and reference it in functions Fixes rust-lang#141837 r? ``@workingjubilee``

Rollup of 11 pull requests Successful merges: - #141829 (Specialize sleep_until implementation for unix (except mac)) - #141847 (Explain `TOCTOU` on the top of `std::fs`, and reference it in functions) - #142138 (Add `Vec::into_chunks`) - #142321 (Expose elf abi on ppc64 targets) - #142886 (ci: aarch64-gnu: Stop skipping `panic_abort_doc_tests`) - #143038 (avoid suggesting traits from private dependencies) - #143194 (fix bitcast of single-element SIMD vectors) - #143206 (Align attr fixes) - #143258 (Don't recompute `DisambiguatorState` for every RPITIT in trait definition) - #143260 (Use the correct export kind for __rust_alloc_error_handler_should_panic) - #143274 (ci: support optional jobs) r? `@ghost` `@rustbot` modify labels: rollup

Explain `TOCTOU` on the top of `std::fs`, and reference it in functions Fixes rust-lang#141837 r? ```@workingjubilee```

Rollup of 12 pull requests Successful merges: - #141847 (Explain `TOCTOU` on the top of `std::fs`, and reference it in functions) - #142138 (Add `Vec::into_chunks`) - #142321 (Expose elf abi on ppc64 targets) - #142886 (ci: aarch64-gnu: Stop skipping `panic_abort_doc_tests`) - #143038 (avoid suggesting traits from private dependencies) - #143194 (fix bitcast of single-element SIMD vectors) - #143206 (Align attr fixes) - #143231 (Suggest use another lifetime specifier instead of underscore lifetime) - #143232 ([COMPILETEST-UNTANGLE 3/N] Use "directives" consistently within compiletest) - #143258 (Don't recompute `DisambiguatorState` for every RPITIT in trait definition) - #143260 (Use the correct export kind for __rust_alloc_error_handler_should_panic) - #143274 (ci: support optional jobs) r? `@ghost` `@rustbot` modify labels: rollup

Explain `TOCTOU` on the top of `std::fs`, and reference it in functions Fixes rust-lang#141837 r? ````@workingjubilee````

Rollup of 11 pull requests Successful merges: - #141847 (Explain `TOCTOU` on the top of `std::fs`, and reference it in functions) - #142138 (Add `Vec::into_chunks`) - #142321 (Expose elf abi on ppc64 targets) - #142886 (ci: aarch64-gnu: Stop skipping `panic_abort_doc_tests`) - #143038 (avoid suggesting traits from private dependencies) - #143194 (fix bitcast of single-element SIMD vectors) - #143231 (Suggest use another lifetime specifier instead of underscore lifetime) - #143232 ([COMPILETEST-UNTANGLE 3/N] Use "directives" consistently within compiletest) - #143258 (Don't recompute `DisambiguatorState` for every RPITIT in trait definition) - #143260 (Use the correct export kind for __rust_alloc_error_handler_should_panic) - #143274 (ci: support optional jobs) r? `@ghost` `@rustbot` modify labels: rollup

Explain `TOCTOU` on the top of `std::fs`, and reference it in functions Fixes rust-lang#141837 r? `````@workingjubilee`````

Rollup of 10 pull requests Successful merges: - #141847 (Explain `TOCTOU` on the top of `std::fs`, and reference it in functions) - #142138 (Add `Vec::into_chunks`) - #142321 (Expose elf abi on ppc64 targets) - #142886 (ci: aarch64-gnu: Stop skipping `panic_abort_doc_tests`) - #143194 (fix bitcast of single-element SIMD vectors) - #143231 (Suggest use another lifetime specifier instead of underscore lifetime) - #143232 ([COMPILETEST-UNTANGLE 3/N] Use "directives" consistently within compiletest) - #143258 (Don't recompute `DisambiguatorState` for every RPITIT in trait definition) - #143260 (Use the correct export kind for __rust_alloc_error_handler_should_panic) - #143274 (ci: support optional jobs) r? `@ghost` `@rustbot` modify labels: rollup

Rollup of 9 pull requests Successful merges: - #141847 (Explain `TOCTOU` on the top of `std::fs`, and reference it in functions) - #142138 (Add `Vec::into_chunks`) - #142321 (Expose elf abi on ppc64 targets) - #142886 (ci: aarch64-gnu: Stop skipping `panic_abort_doc_tests`) - #143194 (fix bitcast of single-element SIMD vectors) - #143231 (Suggest use another lifetime specifier instead of underscore lifetime) - #143232 ([COMPILETEST-UNTANGLE 3/N] Use "directives" consistently within compiletest) - #143258 (Don't recompute `DisambiguatorState` for every RPITIT in trait definition) - #143274 (ci: support optional jobs) r? `@ghost` `@rustbot` modify labels: rollup

Rollup merge of #141847 - xizheyin:141837, r=jhpratt Explain `TOCTOU` on the top of `std::fs`, and reference it in functions Fixes #141837 r? ``````@workingjubilee``````

rustbot assigned workingjubilee Jun 1, 2025

rustbot added S-waiting-on-review T-libs labels Jun 1, 2025

This comment has been minimized.

Sign in to view

ChrisDenton reviewed Jun 1, 2025

View reviewed changes

library/std/src/fs.rs Outdated Show resolved Hide resolved

library/std/src/fs.rs Outdated Show resolved Hide resolved

library/std/src/fs.rs Outdated Show resolved Hide resolved

Explain TOCTOU on the top of std::fs, and ref it in functions

e95751a

Signed-off-by: xizheyin <xizheyin@smail.nju.edu.cn> Signed-off-by: xizheyin <xizheyin@smail.nju.edu.cn>

xizheyin force-pushed the 141837 branch from 0f0315b to e95751a Compare June 2, 2025 09:45

xizheyin commented Jun 2, 2025

View reviewed changes

rustbot assigned thomcc and unassigned workingjubilee Jun 11, 2025

rustbot assigned jhpratt and unassigned thomcc Jun 29, 2025

bors added S-waiting-on-bors and removed S-waiting-on-review labels Jul 1, 2025

jhpratt added a commit to jhpratt/rust that referenced this pull request Jul 1, 2025

Rollup merge of rust-lang#141847 - xizheyin:141837, r=jhpratt

c43faef

Explain `TOCTOU` on the top of `std::fs`, and reference it in functions Fixes rust-lang#141837 r? `@workingjubilee`

jhpratt mentioned this pull request Jul 1, 2025

Rollup of 12 pull requests #143305

Closed

jhpratt added a commit to jhpratt/rust that referenced this pull request Jul 2, 2025

Rollup merge of rust-lang#141847 - xizheyin:141837, r=jhpratt

04638e8

Explain `TOCTOU` on the top of `std::fs`, and reference it in functions Fixes rust-lang#141837 r? ``@workingjubilee``

jhpratt mentioned this pull request Jul 2, 2025

Rollup of 11 pull requests #143311

Closed

jhpratt added a commit to jhpratt/rust that referenced this pull request Jul 2, 2025

Rollup merge of rust-lang#141847 - xizheyin:141837, r=jhpratt

1aa4a5f

Explain `TOCTOU` on the top of `std::fs`, and reference it in functions Fixes rust-lang#141837 r? ```@workingjubilee```

jhpratt mentioned this pull request Jul 2, 2025

Rollup of 12 pull requests #143313

Closed

matthiaskrgr added a commit to matthiaskrgr/rust that referenced this pull request Jul 2, 2025

Rollup merge of rust-lang#141847 - xizheyin:141837, r=jhpratt

fd147cd

Explain `TOCTOU` on the top of `std::fs`, and reference it in functions Fixes rust-lang#141837 r? ````@workingjubilee````

matthiaskrgr mentioned this pull request Jul 2, 2025

Rollup of 11 pull requests #143317

Closed

matthiaskrgr added a commit to matthiaskrgr/rust that referenced this pull request Jul 2, 2025

Rollup merge of rust-lang#141847 - xizheyin:141837, r=jhpratt

0c60f2b

Explain `TOCTOU` on the top of `std::fs`, and reference it in functions Fixes rust-lang#141837 r? `````@workingjubilee`````

matthiaskrgr mentioned this pull request Jul 2, 2025

Rollup of 10 pull requests #143322

Closed

matthiaskrgr mentioned this pull request Jul 2, 2025

Rollup of 9 pull requests #143337

Merged

bors merged commit 0d5af18 into rust-lang:master Jul 2, 2025
9 checks passed

rustbot added this to the 1.90.0 milestone Jul 2, 2025

rust-timer added a commit that referenced this pull request Jul 2, 2025

Unrolled build for #141847

4533d57

Rollup merge of #141847 - xizheyin:141837, r=jhpratt Explain `TOCTOU` on the top of `std::fs`, and reference it in functions Fixes #141837 r? ``````@workingjubilee``````

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Explain `TOCTOU` on the top of `std::fs`, and reference it in functions #141847

Explain `TOCTOU` on the top of `std::fs`, and reference it in functions #141847

xizheyin commented Jun 1, 2025 •

edited by rustbot

Loading

Uh oh!

This comment has been minimized.

workingjubilee commented Jun 1, 2025

Uh oh!

xizheyin commented Jun 1, 2025 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

xizheyin Jun 2, 2025

Uh oh!

xizheyin Jun 2, 2025

Uh oh!

workingjubilee commented Jun 11, 2025

Uh oh!

rustbot commented Jun 11, 2025

Uh oh!

xizheyin commented Jun 29, 2025

Uh oh!

jhpratt commented Jul 1, 2025

Uh oh!

bors commented Jul 1, 2025

Uh oh!

Uh oh!

Uh oh!

Explain TOCTOU on the top of std::fs, and reference it in functions #141847

Explain TOCTOU on the top of std::fs, and reference it in functions #141847

Conversation

xizheyin commented Jun 1, 2025 • edited by rustbot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This comment has been minimized.

workingjubilee commented Jun 1, 2025

Uh oh!

xizheyin commented Jun 1, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

xizheyin Jun 2, 2025

Choose a reason for hiding this comment

Uh oh!

xizheyin Jun 2, 2025

Choose a reason for hiding this comment

Uh oh!

workingjubilee commented Jun 11, 2025

Uh oh!

rustbot commented Jun 11, 2025

Uh oh!

xizheyin commented Jun 29, 2025

Uh oh!

jhpratt commented Jul 1, 2025

Uh oh!

bors commented Jul 1, 2025

Uh oh!

Uh oh!

Uh oh!

Explain `TOCTOU` on the top of `std::fs`, and reference it in functions #141847

Explain `TOCTOU` on the top of `std::fs`, and reference it in functions #141847

xizheyin commented Jun 1, 2025 •

edited by rustbot

Loading

xizheyin commented Jun 1, 2025 •

edited

Loading