1 /* Temporary directories and temporary files with automatic cleanup.
2 Copyright (C) 2001, 2003, 2006-2007 Free Software Foundation, Inc.
3 Written by Bruno Haible <bruno@clisp.org>, 2006.
5 This program is free software: you can redistribute it and/or modify
6 it under the terms of the GNU General Public License as published by
7 the Free Software Foundation; either version 3 of the License, or
8 (at your option) any later version.
10 This program is distributed in the hope that it will be useful,
11 but WITHOUT ANY WARRANTY; without even the implied warranty of
12 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 GNU General Public License for more details.
15 You should have received a copy of the GNU General Public License
16 along with this program. If not, see <http://www.gnu.org/licenses/>. */
22 #include "clean-temp.h"
32 #if (defined _WIN32 || defined __WIN32__) && ! defined __CYGWIN__
33 # define WIN32_LEAN_AND_MEAN /* avoid including junk */
38 #include "fatal-signal.h"
43 #include "gl_linkedhash_list.h"
45 #if GNULIB_FWRITEERROR
46 # include "fwriteerror.h"
48 #if GNULIB_CLOSE_STREAM
49 # include "close-stream.h"
51 #if GNULIB_FCNTL_SAFER
54 #if GNULIB_FOPEN_SAFER
58 #define _(str) gettext (str)
60 /* GNU Hurd doesn't have PATH_MAX. */
63 # define PATH_MAX MAXPATHLEN
65 # define PATH_MAX 1024
70 # define uintptr_t unsigned long
73 #if !GNULIB_FCNTL_SAFER
74 /* The results of open() in this file are not used with fchdir,
75 therefore save some unnecessary work in fchdir.c. */
81 /* The use of 'volatile' in the types below (and ISO C 99 section 5.1.2.3.(5))
82 ensure that while constructing or modifying the data structures, the field
83 values are written to memory in the order of the C statements. So the
84 signal handler can rely on these field values to be up to date. */
87 /* Registry for a single temporary directory.
88 'struct temp_dir' from the public header file overlaps with this. */
91 /* The absolute pathname of the directory. */
92 char * volatile dirname;
93 /* Whether errors during explicit cleanup are reported to standard error. */
95 /* Absolute pathnames of subdirectories. */
96 gl_list_t /* <char *> */ volatile subdirs;
97 /* Absolute pathnames of files. */
98 gl_list_t /* <char *> */ volatile files;
101 /* List of all temporary directories. */
104 struct tempdir * volatile * volatile tempdir_list;
105 size_t volatile tempdir_count;
106 size_t tempdir_allocated;
107 } cleanup_list /* = { NULL, 0, 0 } */;
109 /* List of all open file descriptors to temporary files. */
110 static gl_list_t /* <int> */ volatile descriptors;
113 /* For the subdirs and for the files, we use a gl_list_t of type LINKEDHASH.
114 Why? We need a data structure that
116 1) Can contain an arbitrary number of 'char *' values. The strings
117 are compared via strcmp, not pointer comparison.
118 2) Has insertion and deletion operations that are fast: ideally O(1),
119 or possibly O(log n). This is important for GNU sort, which may
120 create a large number of temporary files.
121 3) Allows iteration through all elements from within a signal handler.
122 4) May or may not allow duplicates. It doesn't matter here, since
123 any file or subdir can only be removed once.
125 Criterion 1) would allow any gl_list_t or gl_oset_t implementation.
127 Criterion 2) leaves only GL_LINKEDHASH_LIST, GL_TREEHASH_LIST, or
130 Criterion 3) puts at disadvantage GL_TREEHASH_LIST and GL_TREE_OSET.
131 Namely, iteration through the elements of a binary tree requires access
132 to many ->left, ->right, ->parent pointers. However, the rebalancing
133 code for insertion and deletion in an AVL or red-black tree is so
134 complicated that we cannot assume that >left, ->right, ->parent pointers
135 are in a consistent state throughout these operations. Therefore, to
136 avoid a crash in the signal handler, all destructive operations to the
137 lists would have to be protected by a
138 block_fatal_signals ();
140 unblock_fatal_signals ();
141 pair. Which causes extra system calls.
143 Criterion 3) would also discourage GL_ARRAY_LIST and GL_CARRAY_LIST,
144 if they were not already excluded. Namely, these implementations use
145 xrealloc(), leaving a time window in which in the list->elements pointer
146 points to already deallocated memory. To avoid a crash in the signal
147 handler at such a moment, all destructive operations would have to
148 protected by block/unblock_fatal_signals (), in this case too.
150 A list of type GL_LINKEDHASH_LIST without duplicates fulfills all
152 2) Insertion and deletion are O(1) on average.
153 3) The gl_list_iterator, gl_list_iterator_next implementations do
154 not trigger memory allocations, nor other system calls, and are
155 therefore safe to be called from a signal handler.
156 Furthermore, since SIGNAL_SAFE_LIST is defined, the implementation
157 of the destructive functions ensures that the list structure is
158 safe to be traversed at any moment, even when interrupted by an
162 /* String equality and hash code functions used by the lists. */
165 string_equals (const void *x1, const void *x2)
167 const char *s1 = (const char *) x1;
168 const char *s2 = (const char *) x2;
169 return strcmp (s1, s2) == 0;
172 #define SIZE_BITS (sizeof (size_t) * CHAR_BIT)
174 /* A hash function for NUL-terminated char* strings using
175 the method described by Bruno Haible.
176 See http://www.haible.de/bruno/hashfunc.html. */
178 string_hash (const void *x)
180 const char *s = (const char *) x;
184 h = *s + ((h << 9) | (h >> (SIZE_BITS - 9)));
190 /* The signal handler. It gets called asynchronously. */
196 /* First close all file descriptors to temporary files. */
198 gl_list_t fds = descriptors;
202 gl_list_iterator_t iter;
205 iter = gl_list_iterator (fds);
206 while (gl_list_iterator_next (&iter, &element, NULL))
208 int fd = (int) (uintptr_t) element;
211 gl_list_iterator_free (&iter);
215 for (i = 0; i < cleanup_list.tempdir_count; i++)
217 struct tempdir *dir = cleanup_list.tempdir_list[i];
221 gl_list_iterator_t iter;
224 /* First cleanup the files in the subdirectories. */
225 iter = gl_list_iterator (dir->files);
226 while (gl_list_iterator_next (&iter, &element, NULL))
228 const char *file = (const char *) element;
231 gl_list_iterator_free (&iter);
233 /* Then cleanup the subdirectories. */
234 iter = gl_list_iterator (dir->subdirs);
235 while (gl_list_iterator_next (&iter, &element, NULL))
237 const char *subdir = (const char *) element;
240 gl_list_iterator_free (&iter);
242 /* Then cleanup the temporary directory itself. */
243 rmdir (dir->dirname);
248 /* Create a temporary directory.
249 PREFIX is used as a prefix for the name of the temporary directory. It
250 should be short and still give an indication about the program.
251 PARENTDIR can be used to specify the parent directory; if NULL, a default
252 parent directory is used (either $TMPDIR or /tmp or similar).
253 CLEANUP_VERBOSE determines whether errors during explicit cleanup are
254 reported to standard error.
255 Return a fresh 'struct temp_dir' on success. Upon error, an error message
256 is shown and NULL is returned. */
258 create_temp_dir (const char *prefix, const char *parentdir,
259 bool cleanup_verbose)
261 struct tempdir * volatile *tmpdirp = NULL;
262 struct tempdir *tmpdir;
267 /* See whether it can take the slot of an earlier temporary directory
268 already cleaned up. */
269 for (i = 0; i < cleanup_list.tempdir_count; i++)
270 if (cleanup_list.tempdir_list[i] == NULL)
272 tmpdirp = &cleanup_list.tempdir_list[i];
277 /* See whether the array needs to be extended. */
278 if (cleanup_list.tempdir_count == cleanup_list.tempdir_allocated)
280 /* Note that we cannot use xrealloc(), because then the cleanup()
281 function could access an already deallocated array. */
282 struct tempdir * volatile *old_array = cleanup_list.tempdir_list;
283 size_t old_allocated = cleanup_list.tempdir_allocated;
284 size_t new_allocated = 2 * cleanup_list.tempdir_allocated + 1;
285 struct tempdir * volatile *new_array =
286 XNMALLOC (new_allocated, struct tempdir * volatile);
288 if (old_allocated == 0)
289 /* First use of this facility. Register the cleanup handler. */
290 at_fatal_signal (&cleanup);
293 /* Don't use memcpy() here, because memcpy takes non-volatile
294 arguments and is therefore not guaranteed to complete all
295 memory stores before the next statement. */
298 for (k = 0; k < old_allocated; k++)
299 new_array[k] = old_array[k];
302 cleanup_list.tempdir_list = new_array;
303 cleanup_list.tempdir_allocated = new_allocated;
305 /* Now we can free the old array. */
306 if (old_array != NULL)
307 free ((struct tempdir **) old_array);
310 tmpdirp = &cleanup_list.tempdir_list[cleanup_list.tempdir_count];
311 /* Initialize *tmpdirp before incrementing tempdir_count, so that
312 cleanup() will skip this entry before it is fully initialized. */
314 cleanup_list.tempdir_count++;
317 /* Initialize a 'struct tempdir'. */
318 tmpdir = XMALLOC (struct tempdir);
319 tmpdir->dirname = NULL;
320 tmpdir->cleanup_verbose = cleanup_verbose;
321 tmpdir->subdirs = gl_list_create_empty (GL_LINKEDHASH_LIST,
322 string_equals, string_hash, NULL,
324 tmpdir->files = gl_list_create_empty (GL_LINKEDHASH_LIST,
325 string_equals, string_hash, NULL,
328 /* Create the temporary directory. */
329 xtemplate = (char *) xmalloca (PATH_MAX);
330 if (path_search (xtemplate, PATH_MAX, parentdir, prefix, parentdir == NULL))
333 _("cannot find a temporary directory, try setting $TMPDIR"));
336 block_fatal_signals ();
337 tmpdirname = mkdtemp (xtemplate);
338 if (tmpdirname != NULL)
340 tmpdir->dirname = tmpdirname;
343 unblock_fatal_signals ();
344 if (tmpdirname == NULL)
347 _("cannot create a temporary directory using template \"%s\""),
351 /* Replace tmpdir->dirname with a copy that has indefinite extent.
352 We cannot do this inside the block_fatal_signals/unblock_fatal_signals
353 block because then the cleanup handler would not remove the directory
355 tmpdir->dirname = xstrdup (tmpdirname);
357 return (struct temp_dir *) tmpdir;
364 /* Register the given ABSOLUTE_FILE_NAME as being a file inside DIR, that
365 needs to be removed before DIR can be removed.
366 Should be called before the file ABSOLUTE_FILE_NAME is created. */
368 register_temp_file (struct temp_dir *dir,
369 const char *absolute_file_name)
371 struct tempdir *tmpdir = (struct tempdir *)dir;
373 /* Add absolute_file_name to tmpdir->files, without duplicates. */
374 if (gl_list_search (tmpdir->files, absolute_file_name) == NULL)
375 gl_list_add_first (tmpdir->files, xstrdup (absolute_file_name));
378 /* Unregister the given ABSOLUTE_FILE_NAME as being a file inside DIR, that
379 needs to be removed before DIR can be removed.
380 Should be called when the file ABSOLUTE_FILE_NAME could not be created. */
382 unregister_temp_file (struct temp_dir *dir,
383 const char *absolute_file_name)
385 struct tempdir *tmpdir = (struct tempdir *)dir;
386 gl_list_t list = tmpdir->files;
389 node = gl_list_search (list, absolute_file_name);
392 char *old_string = (char *) gl_list_node_value (list, node);
394 gl_list_remove_node (list, node);
399 /* Register the given ABSOLUTE_DIR_NAME as being a subdirectory inside DIR,
400 that needs to be removed before DIR can be removed.
401 Should be called before the subdirectory ABSOLUTE_DIR_NAME is created. */
403 register_temp_subdir (struct temp_dir *dir,
404 const char *absolute_dir_name)
406 struct tempdir *tmpdir = (struct tempdir *)dir;
408 /* Add absolute_dir_name to tmpdir->subdirs, without duplicates. */
409 if (gl_list_search (tmpdir->subdirs, absolute_dir_name) == NULL)
410 gl_list_add_first (tmpdir->subdirs, xstrdup (absolute_dir_name));
413 /* Unregister the given ABSOLUTE_DIR_NAME as being a subdirectory inside DIR,
414 that needs to be removed before DIR can be removed.
415 Should be called when the subdirectory ABSOLUTE_DIR_NAME could not be
418 unregister_temp_subdir (struct temp_dir *dir,
419 const char *absolute_dir_name)
421 struct tempdir *tmpdir = (struct tempdir *)dir;
422 gl_list_t list = tmpdir->subdirs;
425 node = gl_list_search (list, absolute_dir_name);
428 char *old_string = (char *) gl_list_node_value (list, node);
430 gl_list_remove_node (list, node);
435 /* Remove a file, with optional error message.
436 Return 0 upon success, or -1 if there was some problem. */
438 do_unlink (struct temp_dir *dir, const char *absolute_file_name)
440 if (unlink (absolute_file_name) < 0 && dir->cleanup_verbose
443 error (0, errno, _("cannot remove temporary file %s"), absolute_file_name);
449 /* Remove a directory, with optional error message.
450 Return 0 upon success, or -1 if there was some problem. */
452 do_rmdir (struct temp_dir *dir, const char *absolute_dir_name)
454 if (rmdir (absolute_dir_name) < 0 && dir->cleanup_verbose
458 _("cannot remove temporary directory %s"), absolute_dir_name);
464 /* Remove the given ABSOLUTE_FILE_NAME and unregister it.
465 Return 0 upon success, or -1 if there was some problem. */
467 cleanup_temp_file (struct temp_dir *dir,
468 const char *absolute_file_name)
472 err = do_unlink (dir, absolute_file_name);
473 unregister_temp_file (dir, absolute_file_name);
478 /* Remove the given ABSOLUTE_DIR_NAME and unregister it.
479 Return 0 upon success, or -1 if there was some problem. */
481 cleanup_temp_subdir (struct temp_dir *dir,
482 const char *absolute_dir_name)
486 err = do_rmdir (dir, absolute_dir_name);
487 unregister_temp_subdir (dir, absolute_dir_name);
492 /* Remove all registered files and subdirectories inside DIR.
493 Return 0 upon success, or -1 if there was some problem. */
495 cleanup_temp_dir_contents (struct temp_dir *dir)
497 struct tempdir *tmpdir = (struct tempdir *)dir;
500 gl_list_iterator_t iter;
504 /* First cleanup the files in the subdirectories. */
505 list = tmpdir->files;
506 iter = gl_list_iterator (list);
507 while (gl_list_iterator_next (&iter, &element, &node))
509 char *file = (char *) element;
511 err |= do_unlink (dir, file);
512 gl_list_remove_node (list, node);
513 /* Now only we can free file. */
516 gl_list_iterator_free (&iter);
518 /* Then cleanup the subdirectories. */
519 list = tmpdir->subdirs;
520 iter = gl_list_iterator (list);
521 while (gl_list_iterator_next (&iter, &element, &node))
523 char *subdir = (char *) element;
525 err |= do_rmdir (dir, subdir);
526 gl_list_remove_node (list, node);
527 /* Now only we can free subdir. */
530 gl_list_iterator_free (&iter);
535 /* Remove all registered files and subdirectories inside DIR and DIR itself.
536 DIR cannot be used any more after this call.
537 Return 0 upon success, or -1 if there was some problem. */
539 cleanup_temp_dir (struct temp_dir *dir)
541 struct tempdir *tmpdir = (struct tempdir *)dir;
545 err |= cleanup_temp_dir_contents (dir);
546 err |= do_rmdir (dir, tmpdir->dirname);
548 for (i = 0; i < cleanup_list.tempdir_count; i++)
549 if (cleanup_list.tempdir_list[i] == tmpdir)
551 /* Remove cleanup_list.tempdir_list[i]. */
552 if (i + 1 == cleanup_list.tempdir_count)
554 while (i > 0 && cleanup_list.tempdir_list[i - 1] == NULL)
556 cleanup_list.tempdir_count = i;
559 cleanup_list.tempdir_list[i] = NULL;
560 /* Now only we can free the tmpdir->dirname and tmpdir itself. */
561 free (tmpdir->dirname);
566 /* The user passed an invalid DIR argument. */
571 #if (defined _WIN32 || defined __WIN32__) && ! defined __CYGWIN__
573 /* On Windows, opening a file with _O_TEMPORARY has the effect of passing
574 the FILE_FLAG_DELETE_ON_CLOSE flag to CreateFile(), which has the effect
575 of deleting the file when it is closed - even when the program crashes.
576 But (according to the Cygwin sources) it works only on Windows NT or newer.
577 So we cache the info whether we are running on Windows NT or newer. */
580 supports_delete_on_close ()
582 static int known; /* 1 = yes, -1 = no, 0 = unknown */
587 if (GetVersionEx (&v))
588 known = (v.dwPlatformId == VER_PLATFORM_WIN32_NT ? 1 : -1);
598 /* Register a file descriptor to be closed. */
602 if (descriptors == NULL)
603 descriptors = gl_list_create_empty (GL_LINKEDHASH_LIST, NULL, NULL, NULL,
605 gl_list_add_first (descriptors, (void *) (uintptr_t) fd);
608 /* Unregister a file descriptor to be closed. */
610 unregister_fd (int fd)
612 gl_list_t fds = descriptors;
616 /* descriptors should already contain fd. */
618 node = gl_list_search (fds, (void *) (uintptr_t) fd);
620 /* descriptors should already contain fd. */
622 gl_list_remove_node (fds, node);
625 /* Open a temporary file in a temporary directory.
626 Registers the resulting file descriptor to be closed. */
628 open_temp (const char *file_name, int flags, mode_t mode)
633 block_fatal_signals ();
634 /* Note: 'open' here is actually open() or open_safer(). */
635 #if (defined _WIN32 || defined __WIN32__) && ! defined __CYGWIN__
636 /* Use _O_TEMPORARY when possible, to increase the chances that the
637 temporary file is removed when the process crashes. */
638 if (supports_delete_on_close ())
639 fd = open (file_name, flags | _O_TEMPORARY, mode);
642 fd = open (file_name, flags, mode);
646 unblock_fatal_signals ();
651 /* Open a temporary file in a temporary directory.
652 Registers the resulting file descriptor to be closed. */
654 fopen_temp (const char *file_name, const char *mode)
659 block_fatal_signals ();
660 /* Note: 'fopen' here is actually fopen() or fopen_safer(). */
661 #if (defined _WIN32 || defined __WIN32__) && ! defined __CYGWIN__
662 /* Use _O_TEMPORARY when possible, to increase the chances that the
663 temporary file is removed when the process crashes. */
664 if (supports_delete_on_close ())
666 size_t mode_len = strlen (mode);
667 char *augmented_mode = (char *) xmalloca (mode_len + 2);
668 memcpy (augmented_mode, mode, mode_len);
669 memcpy (augmented_mode + mode_len, "D", 2);
671 fp = fopen (file_name, augmented_mode);
674 freea (augmented_mode);
679 fp = fopen (file_name, mode);
684 /* It is sufficient to register fileno (fp) instead of the entire fp,
685 because at cleanup time there is no need to do an fflush (fp); a
686 close (fileno (fp)) will be enough. */
687 int fd = fileno (fp);
692 unblock_fatal_signals ();
697 /* Close a temporary file in a temporary directory.
698 Unregisters the previously registered file descriptor. */
704 /* No blocking of signals is needed here, since a double close of a
705 file descriptor is harmless. */
706 int result = close (fd);
707 int saved_errno = errno;
709 /* No race condition here: we assume a single-threaded program, hence
710 fd cannot be re-opened here. */
721 /* Close a temporary file in a temporary directory.
722 Unregisters the previously registered file descriptor. */
724 fclose_temp (FILE *fp)
726 int fd = fileno (fp);
727 /* No blocking of signals is needed here, since a double close of a
728 file descriptor is harmless. */
729 int result = fclose (fp);
730 int saved_errno = errno;
732 /* No race condition here: we assume a single-threaded program, hence
733 fd cannot be re-opened here. */
741 #if GNULIB_FWRITEERROR
743 Unregisters the previously registered file descriptor. */
745 fwriteerror_temp (FILE *fp)
747 int fd = fileno (fp);
748 /* No blocking of signals is needed here, since a double close of a
749 file descriptor is harmless. */
750 int result = fwriteerror (fp);
751 int saved_errno = errno;
753 /* No race condition here: we assume a single-threaded program, hence
754 fd cannot be re-opened here. */
763 #if GNULIB_CLOSE_STREAM
764 /* Like close_stream.
765 Unregisters the previously registered file descriptor. */
767 close_stream_temp (FILE *fp)
769 int fd = fileno (fp);
770 /* No blocking of signals is needed here, since a double close of a
771 file descriptor is harmless. */
772 int result = close_stream (fp);
773 int saved_errno = errno;
775 /* No race condition here: we assume a single-threaded program, hence
776 fd cannot be re-opened here. */