fn create_private(path: &Path) -> Result<File>Expand description
Open the temporary file for writing: new, and 0600 from the moment it
exists.
fs::write creates with 0666 less the umask, which is 0644 on most
machines, and a mode set afterwards leaves a window in which every device
key is on disk and readable by anyone on the machine. A crash inside that
window leaves them that way for good, under a name nothing goes back to.
Asking open for the mode closes the window; it is how modelpipe creates
the endpoint identity beside this file.
New, never reused. A file already under this name — a pid used again,
after a reboot or when pids wrap, starts the counter again — keeps the
mode it has, and somebody may have opened it while that let them, holding
a descriptor no chmod reaches; a symlink there sends the open, and its
truncate, to whatever file it names. So open_new refuses a name that is
taken, a link included, and the leftover is removed and the create tried
once more: no other writer on this machine, in this pid namespace, can be
using a name that carries this process’s pid and a count only it drew.
Removing a name writes nothing to the file it named, and removes a link
rather than its target. A second refusal is returned rather than chased,
and so is a leftover that cannot be removed, such as a directory.