[musl] fputs() et al do not return EBADF for read-only files

[musl] fputs() et al do not return EBADF for read-only files

[Demi Marie Obenour]

[-- Attachment #1.1.1: Type: text/plain, Size: 128 bytes --]

See https://github.com/systemd/systemd/pull/39721 which works around this.
-- 
Sincerely,
Demi Marie Obenour (she/her/hers)

[-- Attachment #1.1.2: OpenPGP public key --]
[-- Type: application/pgp-keys, Size: 7253 bytes --]

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [musl] fputs() et al do not return EBADF for read-only files

[Rich Felker]

On Thu, Nov 13, 2025 at 05:21:56PM -0500, Demi Marie Obenour wrote:
> See https://github.com/systemd/systemd/pull/39721 which works around this.

This is expected. Per ISO C, calling an output function on a stream
not opened for output has undefined behavior. Performing an additional
mode check in each putc operation would be relatively costly and
unjustified. This is not an exceptional condition that can happen at
runtime like out-of-memory, insufficient permission, missing file,
etc. Attempting to perform output on an input stream or vice versa is
purely a programming error and the buggy code should be fixed.

Rich

Re: [musl] fputs() et al do not return EBADF for read-only files

[Rich Felker]

On Thu, Nov 13, 2025 at 08:21:34PM -0500, Rich Felker wrote:
> On Thu, Nov 13, 2025 at 05:21:56PM -0500, Demi Marie Obenour wrote:
> > See https://github.com/systemd/systemd/pull/39721 which works around this.
> 
> This is expected. Per ISO C, calling an output function on a stream
> not opened for output has undefined behavior. Performing an additional
> mode check in each putc operation would be relatively costly and
> unjustified. This is not an exceptional condition that can happen at
> runtime like out-of-memory, insufficient permission, missing file,
> etc. Attempting to perform output on an input stream or vice versa is
> purely a programming error and the buggy code should be fixed.

As I was just reminded of it off-list, I'll add that there's a common
misconception here because POSIX does specify EBADF as a "shall fail".
However, the conditions for it are:

    "The fputc() function shall fail if either the stream is
    unbuffered or the stream's buffer needs to be flushed, and:
    
    ...
    
    [EBADF] The file descriptor underlying stream is not a valid file
    descriptor open for writing."

This is a condition on the underlying file descriptor, not on the
stdio FILE stream, and it's only specified to happen under conditions
where an operation on the underlying fd would occur. It can only occur
if fdopen did not check the mode of the file descriptor (not required
IIRC) or if dup2 was used to replace the file descriptor associated
with the stream, or if the stream is stdout or stderr and the process
inherited a file descriptor not open for writing or did not inherit
any file descriptor 1 or 2 at all.

Rich