uutils/coreutils

touch create path TOCTOU: stat then create leading to truncate via race

Open

#10019 opened on Jan 3, 2026

View on GitHub
 (0 comments) (0 reactions) (0 assignees)Rust (23,246 stars) (1,852 forks)batch import
U - touchgood first issuereported-canonical

Description

Component

touch

Description

For a missing path, uutils touch does an existence check first and then creates the file.

File::create() opens with O_CREAT|O_TRUNC, so there is a race window: if another process creates the path (or swaps it to a symlink to an existing file) between the stat and the create, touch will open with truncation.

GNU touch does not have this specific pattern on create: it uses a single openat(O_CREAT) without a prior existence check and without O_TRUNC.

Test / Reproduction Steps

Syscall trace on a missing path:

uutils:

statx(AT_FDCWD, "/tmp/touch-sys/newfile", ..., ...) = -1 ENOENT
openat(AT_FDCWD, "/tmp/touch-sys/newfile", O_WRONLY|O_CREAT|O_TRUNC|O_CLOEXEC, 0666) = 3

GNU:

openat(AT_FDCWD, "/tmp/touch-sys/newfile", O_WRONLY|O_CREAT|O_NOCTTY|O_NONBLOCK, 0666) = 3
utimensat(0, NULL, NULL, 0) = 0

Impact

Race window for unintended truncation/clobbering when touch is run in attacker-writable directories or on attacker-controlled paths, especially when run with elevated privileges.

Contributor guide

Tech stack
rust
Domain
clisecurity
Issue type
security
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
half day
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
fresh
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
clear
Prerequisites
RustFile system basics
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
40
Research direction
The issue is in the `touch` component. Compare the current implementation's stat then create pattern with GNU's single openat without O TRUNC. Look at the source file for touch (likely `src/touch.rs`). Consider using methods like `OpenOptions::new().write(true).create(true)` without truncation and then set the timestamps with `utimensat`.