[9fans] create(2)/open(2) race for file creation

[G. David Butler gdb@dbSystems.com]

>From: "G. David Butler" <gdb@dbSystems.com>
>
>Another alternative would be to change create(2) to simply call
>create(5) and return the results.  There will need to be some
>cleanup of programs that assume that a create on a existing file
>is OK, but if that is the case it is easy to change:
>
>if ((fd = create(file, mode, perm)) < 0) {
>	error...
>}
>
>to:
>
>if ((fd = create(file, mode, perm)) < 0 ||
>    (fd = open(file, mode|OTRUNC) < 0)) {
>	error...
>}
>
>In those programs.
>
>Any comments?

I'm surprised I haven't yet seen "What about union directories?"

If create(2) is changed then it could succeed even though a
file with that name exists in the union.  Then the above:

if ((fd = create(file, mode, perm)) < 0) {
	error...
}

Would need to become:

if ((fd = open(file, mode|OTRUNC)) < 0 ||
    (fd = create(file, mode, perm)) < 0 ||
    (fd = open(file, mode|OTRUNC)) < 0 ||
	error...
}

This is precisely the current create(2) call and the nasty
race is clear.

At this point an application could remove the OTRUNC from the
last open and know what is happening and deal with it as
appropriate.

So another advantage of changing create(2) to simply use create(5)
is the application now has more control over the behavior of
union directories.

For example one could mount a creatable directory before a
directory of readonly files and could have file updates "replace"
the readonly ones.  Currently one would get an error because you
can't write the file that exists.  To do that the application
would have to "know" the creatable directory exists and issue
create(2) to that directory.

In this case the application could do:

if ((fd = create(file, mode, perm)) < 0 ||
    (fd = open(file, mode|OTRUNC) < 0)) {
	error...
}

with no race.

David Butler
gdb@dbSystems.com