Checking for Race Conditions in File Accesses.¶
Bishop, M., & Dilger, M. (1996). Checking for Race Conditions in File Accesses. Computing Systems, 9(2), 131-152.
Cited by¶
2 citations across 2 artifacts.
Each citation links to the sentence it supports in the citing article.
Primes¶
- Time-Of-Check To Time-Of-Use Flaw
- The check consults state via the path, an indirection that can be re-pointed: between \(t_1\) and \(t_2\) an attacker (the mutator) replaces
pathwith a symbolic link to a sensitive system file.This sourceFoundational analysis of the access/open TOCTOU file-access race in Unix and the descriptor-versus-path remedy.
- The check consults state via the path, an indirection that can be re-pointed: between \(t_1\) and \(t_2\) an attacker (the mutator) replaces
- Unverified Precondition
- The action site (role). A locus that will operate on some referenced entity at the moment of commit. The referenced entity (role). An object, capability, counterparty, channel, or resource whose existence-and-availability is the precondition for the action's success. The trust posture (relation). No explicit check at the action site that the referent currently exists — the action presumes the reference resolves. The existence dimension (invariant). Existence — is it there at all? — is a load-bearing precondition separate from any value property (correctness, freshness, schema-conformance, authority); the action's logic is correct given existence, and blind to the existence question itself. The failure surface (relation). When the presumption fails, the action crashes or proceeds with an absence treated as a presence, surfacing downstream far from the missing existence. The site-and-moment invariant. Existence must be verified here and now: verification at the planning site or at an earlier time does not establish existence at the action site at commit — the time-of-check-to-time-of-use gap is the time-window-sensitive instance.
This sourceNames and analyzes the time-of-check-to-time-of-use (TOCTOU) race, where a referent verified at check time is gone or altered by use time — the time-window-sensitive instance of an unverified existence precondition.
- The action site (role). A locus that will operate on some referenced entity at the moment of commit. The referenced entity (role). An object, capability, counterparty, channel, or resource whose existence-and-availability is the precondition for the action's success. The trust posture (relation). No explicit check at the action site that the referent currently exists — the action presumes the reference resolves. The existence dimension (invariant). Existence — is it there at all? — is a load-bearing precondition separate from any value property (correctness, freshness, schema-conformance, authority); the action's logic is correct given existence, and blind to the existence question itself. The failure surface (relation). When the presumption fails, the action crashes or proceeds with an absence treated as a presence, surfacing downstream far from the missing existence. The site-and-moment invariant. Existence must be verified here and now: verification at the planning site or at an earlier time does not establish existence at the action site at commit — the time-of-check-to-time-of-use gap is the time-window-sensitive instance.
Verification¶
This reference passed the adversarial substantiation pipeline: it was checked to exist and to support the claim it is attached to. See how references were verified.
Registry ID ref:516859156078 · see in the full table