Re: save-buffer: avoid data loss on interrupt

[Paul Eggert]

On 12/14/11 06:40, Jim Meyering wrote:

> I can add a test for the presence of an ACL,
> and handle that just like a hard link count of 2 or greater:
> resort to the standard, non-atomic code path.

Yes, but then my reward for trying to be safer and using an ACL
is that my file's contents are more likely to get lost.  Ouch.

Plus, it's not as simple as looking for an ACL on the original
file.  One must also look for ACLs that might be inherited by
the newly created copy.

> If the cost of an extra stat is not prohibitive, I'm
> tempted to keep this change simple, check for a set-UID
> parent directory

I'm afraid it's not as simple as that.  Not only must
the parent directory be setuid, but the file system needs
to be mounted with the suiddir option.  Not all file systems
support that option; some silently ignore it.

And won't we have a problem there with network file systems?
It's not clear to me whether the setuid semantics are
specified by the client OS or the server OS.  (Likewise
for ACLs inherited by the new file.)

All in all, I think that in the long run it'll be simpler and
more reliable if we create the temp file and then check
that it has (or make it have) the correct ownership and permissions.