-
Colin Walters authored
We had a bug previously where we failed to clean up a temporary file in an error path. This is a classic case where the new `O_TMPFILE` API in Linux is nicer. To implement this, as usual we start with some original bits from systemd. But in this case I ended up having to heavily modify it because systemd doesn't support "link into place and overwrite". They don't actually use their tempfile code much at all in fact - as far as I can tell, just in the coredump code. Whereas in many apps, ostree included, a very common use case is atomically updating an existing file, which is `glnx_file_replace_contents_at()`, including subtleties like doing an `fdatasync()` if the file already existed. Implementing this then is slightly weird since we need to link() the file into place, then rename() after. It's still better though because if we e.g. hit `ENOSPC` halfway through, we'll clean up the file automatically. We still do keep the mode where we error out if the file exists. Finally, the ostree core though does have a more unusual case where we want to ignore EEXIST (allow concurrent object writers), so add support for that now. Note: One really confusing bug I had here was that `O_TMPFILE` ignores the provided mode, and this caused ostree to write refs that weren't world readable. Rework things so we always call `fchmod()`, but as a consequence we're no longer honoring umask in the default case. I doubt anyone will care, and if they do we should probably fix ostree to consistently use a mode inherited from the repo or something.
Colin Walters authoredWe had a bug previously where we failed to clean up a temporary file in an error path. This is a classic case where the new `O_TMPFILE` API in Linux is nicer. To implement this, as usual we start with some original bits from systemd. But in this case I ended up having to heavily modify it because systemd doesn't support "link into place and overwrite". They don't actually use their tempfile code much at all in fact - as far as I can tell, just in the coredump code. Whereas in many apps, ostree included, a very common use case is atomically updating an existing file, which is `glnx_file_replace_contents_at()`, including subtleties like doing an `fdatasync()` if the file already existed. Implementing this then is slightly weird since we need to link() the file into place, then rename() after. It's still better though because if we e.g. hit `ENOSPC` halfway through, we'll clean up the file automatically. We still do keep the mode where we error out if the file exists. Finally, the ostree core though does have a more unusual case where we want to ignore EEXIST (allow concurrent object writers), so add support for that now. Note: One really confusing bug I had here was that `O_TMPFILE` ignores the provided mode, and this caused ostree to write refs that weren't world readable. Rework things so we always call `fchmod()`, but as a consequence we're no longer honoring umask in the default case. I doubt anyone will care, and if they do we should probably fix ostree to consistently use a mode inherited from the repo or something.