uutils/coreutils

touch create path TOCTOU: stat then create leading to truncate via race

Open

#10,019 创建于 2026年1月3日

在 GitHub 查看
 (0 评论) (0 反应) (0 负责人)Rust (23,246 star) (1,852 fork)batch import
U - touchgood first issuereported-canonical

描述

Component

touch

Description

For a missing path, uutils touch does an existence check first and then creates the file.

File::create() opens with O_CREAT|O_TRUNC, so there is a race window: if another process creates the path (or swaps it to a symlink to an existing file) between the stat and the create, touch will open with truncation.

GNU touch does not have this specific pattern on create: it uses a single openat(O_CREAT) without a prior existence check and without O_TRUNC.

Test / Reproduction Steps

Syscall trace on a missing path:

uutils:

statx(AT_FDCWD, "/tmp/touch-sys/newfile", ..., ...) = -1 ENOENT
openat(AT_FDCWD, "/tmp/touch-sys/newfile", O_WRONLY|O_CREAT|O_TRUNC|O_CLOEXEC, 0666) = 3

GNU:

openat(AT_FDCWD, "/tmp/touch-sys/newfile", O_WRONLY|O_CREAT|O_NOCTTY|O_NONBLOCK, 0666) = 3
utimensat(0, NULL, NULL, 0) = 0

Impact

Race window for unintended truncation/clobbering when touch is run in attacker-writable directories or on attacker-controlled paths, especially when run with elevated privileges.

贡献者指南

技术栈
rust
领域
clisecurity
议题类型
security
难度面向新贡献者的预计实现难度，1 表示很小改动，5 表示专家级工作。
3
预计时间有经验贡献者完成调查、实现、测试并准备 pull request 的粗略时间范围。
half day
活动状态议题当前的可参与程度：新鲜、活跃、陈旧、阻塞或等待维护者输入。
fresh
清晰度议题是否清楚说明期望改动、验收标准和下一步。
clear
前置要求
RustFile system basics
新手友好度1-100 的估计分数，表示该议题对首次贡献者的友好程度。
40
研究方向
The issue is in the `touch` component. Compare the current implementation's stat then create pattern with GNU's single openat without O TRUNC. Look at the source file for touch (likely `src/touch.rs`). Consider using methods like `OpenOptions::new().write(true).create(true)` without truncation and then set the timestamps with `utimensat`.