touch: remove metadata() call to avoid potential TOCTOU before File::create. #10061

sgmarz · 2026-01-05T01:14:24Z

The metadata() function calls stat at the OS level, which was being checked before File::create() causing a potential race condition between the stat'd file and the opened file (i.e., Time-of-check/time-of-usage problem). This PR uses OpenOptions instead with options to turn off O_TRUNC. It also uses additional flags (O_NOCTTY and O_NONBLOCK) on UNIX targets using OpenOptionsExt. These are POSIX compliant options, so I used cfg(unix) rather than target = "linux". I also had to handle ENXIO separately as touching a FIFO should be fine, but with O_NONBLOCK, this will cause an error. However, the error is not something we care about as it's just telling us it couldn't do anything with the FIFO, so for UNIX targets, that error is ignored like it is for GNU coreutils.

now uutils (after PR):

openat(AT_FDCWD, "abc", O_WRONLY|O_CREAT|O_NOCTTY|O_NONBLOCK|O_CLOEXEC, 0666) = 3
utimensat(AT_FDCWD, "abc", [UTIME_NOW, UTIME_NOW], 0) = 0

stat has been removed as a system call and open now is used to both create and test file errors. To align the error messages with GNU coreutils, such as permission denied, this PR adds an error message to the 'touch-error-cannot-touch' error.

main branch:

$ uu_touch /root/cant_write
touch: setting times of '/root/cant_write': Permission denied
$ gnu_touch /root/cant_write
touch: cannot touch '/root/cant_write': Permission denied

after PR:

$ uu_touch /root/cant_write
touch: cannot touch '/root/cant_write': Permission denied (os error 13)

I did not see it necessary to remove the (os error 13), but can easily be done, but I see it in other utilities, such as install, so I figured it could be left here too.

github-actions · 2026-01-05T02:25:46Z

GNU testsuite comparison:

GNU test failed: tests/cp/perm. tests/cp/perm is passing on 'main'. Maybe you have to rebase?
GNU test failed: tests/touch/fail-diag. tests/touch/fail-diag is passing on 'main'. Maybe you have to rebase?
GNU test failed: tests/touch/no-create-missing. tests/touch/no-create-missing is passing on 'main'. Maybe you have to rebase?
GNU test failed: tests/touch/read-only. tests/touch/read-only is passing on 'main'. Maybe you have to rebase?
GNU test failed: tests/touch/trailing-slash. tests/touch/trailing-slash is passing on 'main'. Maybe you have to rebase?
Skip an intermittent issue tests/timeout/timeout (fails in this run but passes in the 'main' branch)

sgmarz · 2026-01-05T03:04:04Z

Guess my assumption of (os error XX) being OK in the string was wrong as it's causing these to fail.

Some of the failing tests don't align with GNU either:

  TRY 3 FAIL [   0.071s] coreutils::tests test_touch::test_touch_trailing_slash
  stdout ───

    running 1 test
    bin: "/home/runner/work/coreutils/coreutils/target/debug/coreutils"
    run: /home/runner/work/coreutils/coreutils/target/debug/coreutils touch no-file/
    test test_touch::test_touch_trailing_slash ... FAILED

    failures:

    failures:
        test_touch::test_touch_trailing_slash

    test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 4575 filtered out; finished in 0.06s
    
  stderr ───

    thread 'test_touch::test_touch_trailing_slash' panicked at tests/by-util/test_touch.rs:783:39:
    assertion failed: `(left == right)`

    Diff < left / right > :
    <touch: setting times of 'no-file/': No such file or directory
    >touch: cannot touch 'no-file/': No such file or directory

On main branch, I get this:

$ uu_touch no-file/
touch: cannot touch 'no-file/': No such file or directory
$ gnu_touch no-file/
touch: setting times of 'no-file/': No such file or directory

with my PR, it has this behavior:

$ uu_touch no-file/
touch: setting times of 'no-file/': No such file or directory
$ gnu_touch no-file/
touch: setting times of 'no-file/': No such file or directory

The test is failing because it's looking for the behavior of what's currently in the main branch, but I don't think it's in line with GNU coreutil's error message.

Edited to add this test was done with GNU coreutils 9.9 from Arch Linux.

github-actions · 2026-01-05T12:51:00Z

GNU testsuite comparison:

GNU test failed: tests/cksum/md5sum. tests/cksum/md5sum is passing on 'main'. Maybe you have to rebase?
GNU test failed: tests/cp/perm. tests/cp/perm is passing on 'main'. Maybe you have to rebase?
GNU test failed: tests/touch/no-create-missing. tests/touch/no-create-missing is passing on 'main'. Maybe you have to rebase?
GNU test failed: tests/touch/read-only. tests/touch/read-only is passing on 'main'. Maybe you have to rebase?
GNU test failed: tests/touch/trailing-slash. tests/touch/trailing-slash is passing on 'main'. Maybe you have to rebase?
Skipping an intermittent issue tests/timeout/timeout (passes in this run but fails in the 'main' branch)
Congrats! The gnu test tests/basenc/bounded-memory is now passing!
Note: The gnu test tests/dd/no-allocate was skipped on 'main' but is now failing.

Set the default line width to 72 for all page headers in `pr`, regardless of whether a custom date format is being used. Before, a single space was used to separate the three components of the header (date, filename, and page number) if a custom date format was not given.

github-actions · 2026-01-05T13:41:23Z

GNU testsuite comparison:

GNU test failed: tests/cp/perm. tests/cp/perm is passing on 'main'. Maybe you have to rebase?
GNU test failed: tests/touch/no-create-missing. tests/touch/no-create-missing is passing on 'main'. Maybe you have to rebase?
GNU test failed: tests/touch/read-only. tests/touch/read-only is passing on 'main'. Maybe you have to rebase?
GNU test failed: tests/touch/trailing-slash. tests/touch/trailing-slash is passing on 'main'. Maybe you have to rebase?
GNU test failed: tests/tty/tty-eof. tests/tty/tty-eof is passing on 'main'. Maybe you have to rebase?
Congrats! The gnu test tests/basenc/bounded-memory is now passing!
Note: The gnu test tests/dd/no-allocate was skipped on 'main' but is now failing.

…ut GNU coreutils uses "setting times of" error message.

github-actions · 2026-01-05T14:32:46Z

GNU testsuite comparison:

GNU test failed: tests/cp/perm. tests/cp/perm is passing on 'main'. Maybe you have to rebase?
GNU test failed: tests/touch/no-create-missing. tests/touch/no-create-missing is passing on 'main'. Maybe you have to rebase?
GNU test failed: tests/touch/read-only. tests/touch/read-only is passing on 'main'. Maybe you have to rebase?

sylvestre · 2026-01-17T16:53:58Z

src/uu/touch/src/touch.rs

-        if opts.source == Source::Now && opts.date.is_none() {
-            return Ok(());
+    // Use OpenOptions to create the file if it doesn't exist. This is used in lieu of
+    // stat() to avoid TOCTOU issues.


please add this word to the ignore list

sylvestre · 2026-01-17T16:54:35Z

src/uu/touch/src/touch.rs

+    // Originally, the metadata stat() in touch_file() would catch "no create",
+    // but since it was removed to fix TOCTOU issues, we need to handle it here.
+    if let Err(ref e) = result {
+        if opts.no_create && e.kind() != ErrorKind::NotADirectory {


it seems that the logic for handling --no-create with ELOOP (dangling symlinks) is inverted. With --no-create, ELOOP should return Ok(()), not error out
no?

sylvestre · 2026-01-17T16:55:40Z

src/uu/touch/src/touch.rs

            InputFile::Path(path) => (Cow::Borrowed(path), false),
        };
-        touch_file(&path, is_stdout, opts, atime, mtime).map_err(|e| {
+        if let Err(e) = touch_file(&path, is_stdout, opts, atime, mtime).map_err(|e| {


maybe using a match statement could simplify this code ?

sylvestre · 2026-01-17T16:56:21Z

src/uu/touch/src/touch.rs

+
+        // err_good_cause indicates that the error is not one we should ignore
+        if err_good_cause {
+            return Err(TouchError::TouchFileError {


Creating TouchError::TouchFileError inside touch_file() leads to double-wrapping since the caller also wraps it. maybe return UResult instead.

sylvestre · 2026-01-17T16:56:49Z

src/uu/touch/src/touch.rs

+    // but since it was removed to fix TOCTOU issues, we need to handle it here.
+    if let Err(ref e) = result {
+        if opts.no_create && e.kind() != ErrorKind::NotADirectory {
+            #[cfg(any(unix, target_os = "macos"))]


cfg checks use redundant any(unix, target_os = "macos") instead of just unix (macOS is already Unix)

sylvestre · 2026-01-18T09:42:31Z

a few files are conflicting

sgmarz added 3 commits January 4, 2026 20:00

touch: add error message to touch-error-cannot-touch (EN).

ffdc432

touch: add error message to touch-error-cannot-touch (FR).

290c40a

touch: fix TOCTOU issue with stat'ing a file path before File::create()

634de77

sgmarz added 2 commits January 4, 2026 22:14

touch: remove Rust-produced extra error message information.

6098467

touch: manually output certain error messages.

eae9c5f

jfinkels and others added 5 commits January 5, 2026 08:29

cksum.rs: Simple default tag variable

b871811

cksum,hashsum: Drop a message replaced by clap

47a0d2c

build-gnu.sh: Let md5sum.pl clap compatible

b5e240f

touch: fix errors stopping at the first when not in strict mode.

438b700

sgmarz marked this pull request as draft January 5, 2026 13:42

sgmarz and others added 3 commits January 5, 2026 09:02

test_touch: touch no-file/ would give "cannot touch" error message, b…

2421690

…ut GNU coreutils uses "setting times of" error message.

touch: fix error handling with dangling symlinks and loops

b3948c9

uniq: optimize memory usage for ignore-case comparison

23a0ec5

sgmarz marked this pull request as ready for review January 5, 2026 14:06

touch: run cargo fmt

d44cc8e

max-amb and others added 2 commits January 5, 2026 11:57

cp: Added test for permissions copying to an existing file

6027636

touch: use UIoError to report error causes and try to accommodate macos.

bc18887

sylvestre reviewed Jan 17, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

touch: remove metadata() call to avoid potential TOCTOU before File::create. #10061

touch: remove metadata() call to avoid potential TOCTOU before File::create. #10061

Uh oh!

sgmarz commented Jan 5, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Jan 5, 2026

Uh oh!

sgmarz commented Jan 5, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Jan 5, 2026

Uh oh!

github-actions bot commented Jan 5, 2026

Uh oh!

github-actions bot commented Jan 5, 2026

Uh oh!

sylvestre Jan 17, 2026

Uh oh!

sylvestre Jan 17, 2026

Uh oh!

sylvestre Jan 17, 2026

Uh oh!

sylvestre Jan 17, 2026

Uh oh!

sylvestre Jan 17, 2026

Uh oh!

sylvestre commented Jan 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

Uh oh!

touch: remove metadata() call to avoid potential TOCTOU before File::create. #10061

Are you sure you want to change the base?

touch: remove metadata() call to avoid potential TOCTOU before File::create. #10061

Uh oh!

Conversation

sgmarz commented Jan 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Jan 5, 2026

Uh oh!

sgmarz commented Jan 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Jan 5, 2026

Uh oh!

github-actions bot commented Jan 5, 2026

Uh oh!

github-actions bot commented Jan 5, 2026

Uh oh!

sylvestre Jan 17, 2026

Choose a reason for hiding this comment

Uh oh!

sylvestre Jan 17, 2026

Choose a reason for hiding this comment

Uh oh!

sylvestre Jan 17, 2026

Choose a reason for hiding this comment

Uh oh!

sylvestre Jan 17, 2026

Choose a reason for hiding this comment

Uh oh!

sylvestre Jan 17, 2026

Choose a reason for hiding this comment

Uh oh!

sylvestre commented Jan 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

sgmarz commented Jan 5, 2026 •

edited

Loading

sgmarz commented Jan 5, 2026 •

edited

Loading