bug#27986: 26.0.50; `rename-file' can rename files without confirmation

[Philipp Stephani <p.stephani2@gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 2527 bytes --]

Eli Zaretskii <eliz@gnu.org> schrieb am So., 6. Aug. 2017 um 19:05 Uhr:

> > From: Philipp <p.stephani2@gmail.com>
> > Date: Sun, 06 Aug 2017 17:40:18 +0200
> >
> > (rename-file "/tmp/emacs/ẞ" "/tmp/emacs/ß")
> > nil
> >
> > Note how `rename-file' has silently overwritten `ß'.  This is because on
> > macOS, `ß' and `ẞ' are different file names, but Emacs treats them as
> > equal.  Probably the test for case-insensitive file names should be
> > removed altogether
>
> Which one? there are two of them.
>

I guess all of them where correctness would depend on the outcome.


>
> > (it can't work correctly and introduces a filesystem race)
>
> It cannot work correctly _because_ of a possible race or because of
> some other reasons?  If the latter, please elaborate.


As this example shows, there are cases where two case-insensitive filenames
are considered equivalent by Emacs, but different by the actual filesystem.
This is unavoidable, because the definition of "case-insensitive" changes
all the time, both in Emacs and in the filesystems. Generally it's
impossible to detect whether two filenames would refer to the same file
without actually creating the file. And even then the answer depends on how
the file is created, see e.g. FILE_FLAG_POSIX_SEMANTICS. So Emacs can't
compare filenames and make decisions based on the result upon which the
correctness of a critical function depends. Comparing filenames can still
be OK for best-effort attempts at giving the user better error messages or
similar.


> If the former,
> then at least on MS-Windows we have a race anyway, because the
> underlying system APIs are not atomic.


Wouldn't MoveFileExW with MOVE_FILE_REPLACE_EXISTING be atomic?

> and `rename-file' should use link(2) + unlink(2) if renameat2
> > isn't available.
>
> 'link' and 'unlink' accept strings as arguments, not integer numbers
> such as 2.
>

Yes, I mean the functions described in section 2 of the man page. link(2)
is a common markup for this.


>
> More to the point, how can this strategy work on a case-insensitive
> filesystem?  What am I missing?
>

IIUC link(2) + unlink(2) would, if successful, guarantee enough atomicity
in the sense that the old file is now guaranteed to be the new file, and
the call is guaranteed to fail if the new file already exists. I don't
think anything can help with the case-changing problem; I think we just
have to live with an occasional false positive signal in this case.

[-- Attachment #2: Type: text/html, Size: 3602 bytes --]