IJHack / QtPass / 36030464166

93%

Build Type

push

github

Committed by web-flow

Commit Message

Staged writes: place a new file where the filesystem has no hard links (#1928)

Placing a staged file under a name that must not be taken used
linkat(2) only: the one call every POSIX system has that fails with
EEXIST instead of replacing. FAT and exFAT (and some FUSE mounts) have no
hard links and refuse it with EPERM, so on such a store 2.0 could not add
a new entry or copy one without --force; edits, which rename, still
worked. 1.8 is not affected, it has no staged writes.

When linkat() fails because the filesystem cannot link (EPERM, ENOTSUP,
ENOSYS), an exclusive rename takes over: renameat2(RENAME_NOREPLACE) with
glibc 2.28 or newer, renamex_np(RENAME_EXCL) on macOS. Where that is
missing as well (the BSDs, musl, a filesystem that rejects the flag), the
name is checked and then renamed, which leaves a short window for another
writer. The identity check after placement is unchanged.

The tests fake such a filesystem on Linux: the test binary defines
linkat() and renameat2() (libqtpass.a is linked in statically, as for
tst_trayicon's tray double) and refuses QtPass's flag-less linkat with
EPERM and, for the last tier, renameat2 with EINVAL. Both new tests fail
without the fix.


Claude-Session: https://claude.ai/code/session_01JuQsrHonihp1nARE7bzstc

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

Coverage Stats

21 of 21 new or added lines in 1 file covered. (100.0%)

1 existing line in 1 file now uncovered.

8969 of 9655 relevant lines covered (92.89%)

188.38 hits per line