1 /* Lock files for editing.
2 Copyright (C) 1985-1987, 1993-1994, 1996, 1998-2013 Free Software
5 This file is part of GNU Emacs.
7 GNU Emacs is free software: you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation, either version 3 of the License, or
10 (at your option) any later version.
12 GNU Emacs is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
17 You should have received a copy of the GNU General Public License
18 along with GNU Emacs. If not, see <http://www.gnu.org/licenses/>. */
22 #include <sys/types.h>
36 #include <sys/sysctl.h>
37 #endif /* __FreeBSD__ */
44 #include "character.h"
50 #include "w32.h" /* for dostounix_filename */
53 #ifdef CLASH_DETECTION
59 /* A file whose last-modified time is just after the most recent boot.
60 Define this to be NULL to disable checking for this file. */
61 #ifndef BOOT_TIME_FILE
62 #define BOOT_TIME_FILE "/var/run/random-seed"
66 #define WTMP_FILE "/var/log/wtmp"
69 /* Normally use a symbolic link to represent a lock.
70 The strategy: to lock a file FN, create a symlink .#FN in FN's
71 directory, with link data `user@host.pid'. This avoids a single
72 mount (== failure) point for lock files.
74 When the host in the lock data is the current host, we can check if
75 the pid is valid with kill.
77 Otherwise, we could look at a separate file that maps hostnames to
78 reboot times to see if the remote pid can possibly be valid, since we
79 don't want Emacs to have to communicate via pipes or sockets or
80 whatever to other processes, either locally or remotely; rms says
81 that's too unreliable. Hence the separate file, which could
82 theoretically be updated by daemons running separately -- but this
83 whole idea is unimplemented; in practice, at least in our
84 environment, it seems such stale locks arise fairly infrequently, and
85 Emacs' standard methods of dealing with clashes suffice.
87 We use symlinks instead of normal files because (1) they can be
88 stored more efficiently on the filesystem, since the kernel knows
89 they will be small, and (2) all the info about the lock can be read
90 in a single system call (readlink). Although we could use regular
91 files to be useful on old systems lacking symlinks, nowadays
92 virtually all such systems are probably single-user anyway, so it
93 didn't seem worth the complication.
95 Similarly, we don't worry about a possible 14-character limit on
96 file names, because those are all the same systems that don't have
99 This is compatible with the locking scheme used by Interleaf (which
100 has contributed this implementation for Emacs), and was designed by
101 Ethan Jacobson, Kimbo Mundy, and others.
103 --karl@cs.umb.edu/karl@hq.ileaf.com.
105 On some file systems, notably those of MS-Windows, symbolic links
106 do not work well, so instead of a symlink .#FN -> 'user@host.pid',
107 the lock is a regular file .#FN with contents 'user@host.pid'. To
108 establish a lock, a nonce file is created and then renamed to .#FN.
109 On MS-Windows this renaming is atomic unless the lock is forcibly
110 acquired. On other systems the renaming is atomic if the lock is
111 forcibly acquired; if not, the renaming is done via hard links,
112 which is good enough for lock-file purposes.
114 To summarize, race conditions can occur with either:
116 * Forced locks on MS-Windows systems.
118 * Non-forced locks on non-MS-Windows systems that support neither
119 hard nor symbolic links. */
122 /* Return the time of the last system boot. */
124 static time_t boot_time
;
125 static bool boot_time_initialized
;
128 static void get_boot_time_1 (const char *, bool);
134 #if defined (BOOT_TIME)
138 if (boot_time_initialized
)
140 boot_time_initialized
= 1;
142 #if defined (CTL_KERN) && defined (KERN_BOOTTIME)
146 struct timeval boottime_val
;
149 mib
[1] = KERN_BOOTTIME
;
150 size
= sizeof (boottime_val
);
152 if (sysctl (mib
, 2, &boottime_val
, &size
, NULL
, 0) >= 0)
154 boot_time
= boottime_val
.tv_sec
;
158 #endif /* defined (CTL_KERN) && defined (KERN_BOOTTIME) */
163 if (stat (BOOT_TIME_FILE
, &st
) == 0)
165 boot_time
= st
.st_mtime
;
170 #if defined (BOOT_TIME)
172 /* The utmp routines maintain static state.
173 Don't touch that state unless we are initialized,
174 since it might not survive dumping. */
177 #endif /* not CANNOT_DUMP */
179 /* Try to get boot time from utmp before wtmp,
180 since utmp is typically much smaller than wtmp.
181 Passing a null pointer causes get_boot_time_1
182 to inspect the default file, namely utmp. */
183 get_boot_time_1 ((char *) 0, 0);
187 /* Try to get boot time from the current wtmp file. */
188 get_boot_time_1 (WTMP_FILE
, 1);
190 /* If we did not find a boot time in wtmp, look at wtmp, and so on. */
191 for (counter
= 0; counter
< 20 && ! boot_time
; counter
++)
193 char cmd_string
[sizeof WTMP_FILE
".19.gz"];
194 Lisp_Object tempname
, filename
;
195 bool delete_flag
= 0;
199 tempname
= make_formatted_string
200 (cmd_string
, "%s.%d", WTMP_FILE
, counter
);
201 if (! NILP (Ffile_exists_p (tempname
)))
205 tempname
= make_formatted_string (cmd_string
, "%s.%d.gz",
207 if (! NILP (Ffile_exists_p (tempname
)))
211 /* The utmp functions on mescaline.gnu.org accept only
212 file names up to 8 characters long. Choose a 2
213 character long prefix, and call make_temp_file with
214 second arg non-zero, so that it will add not more
215 than 6 characters to the prefix. */
216 filename
= Fexpand_file_name (build_string ("wt"),
217 Vtemporary_file_directory
);
218 filename
= make_temp_name (filename
, 1);
219 args
[0] = build_string ("gzip");
221 args
[2] = list2 (QCfile
, filename
);
223 args
[4] = build_string ("-cd");
225 Fcall_process (6, args
);
230 if (! NILP (filename
))
232 get_boot_time_1 (SSDATA (filename
), 1);
234 unlink (SSDATA (filename
));
245 /* Try to get the boot time from wtmp file FILENAME.
246 This succeeds if that file contains a reboot record.
248 If FILENAME is zero, use the same file as before;
249 if no FILENAME has ever been specified, this is the utmp file.
250 Use the newest reboot record if NEWEST,
251 the first reboot record otherwise.
252 Ignore all reboot records on or before BOOT_TIME.
253 Success is indicated by setting BOOT_TIME to a larger value. */
256 get_boot_time_1 (const char *filename
, bool newest
)
258 struct utmp ut
, *utp
;
263 /* On some versions of IRIX, opening a nonexistent file name
264 is likely to crash in the utmp routines. */
265 desc
= emacs_open (filename
, O_RDONLY
, 0);
278 /* Find the next reboot record. */
279 ut
.ut_type
= BOOT_TIME
;
283 /* Compare reboot times and use the newest one. */
284 if (utp
->ut_time
> boot_time
)
286 boot_time
= utp
->ut_time
;
290 /* Advance on element in the file
291 so that getutid won't repeat the same one. */
298 #endif /* BOOT_TIME */
300 /* An arbitrary limit on lock contents length. 8 K should be plenty
301 big enough in practice. */
302 enum { MAX_LFINFO
= 8 * 1024 };
304 /* Here is the structure that stores information about a lock. */
308 /* Location of '@', '.', ':' in USER. If there's no colon, COLON
309 points to the end of USER. */
310 char *at
, *dot
, *colon
;
312 /* Lock file contents USER@HOST.PID with an optional :BOOT_TIME
313 appended. This memory is used as a lock file contents buffer, so
314 it needs room for MAX_LFINFO + 1 bytes. A string " (pid NNNN)"
315 may be appended to the USER@HOST while generating a diagnostic,
316 so make room for its extra bytes (as opposed to ".NNNN") too. */
317 char user
[MAX_LFINFO
+ 1 + sizeof " (pid )" - sizeof "."];
320 /* Write the name of the lock file for FNAME into LOCKNAME. Length
321 will be that of FNAME plus two more for the leading ".#", plus one
323 #define MAKE_LOCK_NAME(lockname, fname) \
324 (lockname = SAFE_ALLOCA (SBYTES (fname) + 2 + 1), \
325 fill_in_lock_file_name (lockname, fname))
328 fill_in_lock_file_name (char *lockfile
, Lisp_Object fn
)
330 char *last_slash
= memrchr (SSDATA (fn
), '/', SBYTES (fn
));
331 char *base
= last_slash
+ 1;
332 ptrdiff_t dirlen
= base
- SSDATA (fn
);
333 memcpy (lockfile
, SSDATA (fn
), dirlen
);
334 lockfile
[dirlen
] = '.';
335 lockfile
[dirlen
+ 1] = '#';
336 strcpy (lockfile
+ dirlen
+ 2, base
);
339 /* For some reason Linux kernels return EPERM on file systems that do
340 not support hard or symbolic links. This symbol documents the quirk.
341 There is no way to tell whether a symlink call fails due to
342 permissions issues or because links are not supported, but luckily
343 the lock file code should work either way. */
344 enum { LINKS_MIGHT_NOT_WORK
= EPERM
};
346 /* Rename OLD to NEW. If FORCE, replace any existing NEW.
347 It is OK if there are temporarily two hard links to OLD.
348 Return 0 if successful, -1 (setting errno) otherwise. */
350 rename_lock_file (char const *old
, char const *new, bool force
)
353 return sys_rename_replace (old
, new, force
);
359 if (link (old
, new) == 0)
360 return unlink (old
) == 0 || errno
== ENOENT
? 0 : -1;
361 if (errno
!= ENOSYS
&& errno
!= LINKS_MIGHT_NOT_WORK
)
364 /* 'link' does not work on this file system. This can occur on
365 a GNU/Linux host mounting a FAT32 file system. Fall back on
366 'rename' after checking that NEW does not exist. There is a
367 potential race condition since some other process may create
368 NEW immediately after the existence check, but it's the best
369 we can portably do here. */
370 if (lstat (new, &st
) == 0 || errno
== EOVERFLOW
)
379 return rename (old
, new);
383 /* Create the lock file FILE with contents CONTENTS. Return 0 if
384 successful, an errno value on failure. If FORCE, remove any
385 existing FILE if necessary. */
388 create_lock_file (char *lfname
, char *lock_info_str
, bool force
)
391 /* Symlinks are supported only by later versions of Windows, and
392 creating them is a privileged operation that often triggers
393 User Account Control elevation prompts. Avoid the problem by
394 pretending that 'symlink' does not work. */
397 int err
= symlink (lock_info_str
, lfname
) == 0 ? 0 : errno
;
400 if (err
== EEXIST
&& force
)
403 err
= symlink (lock_info_str
, lfname
) == 0 ? 0 : errno
;
406 if (err
== ENOSYS
|| err
== LINKS_MIGHT_NOT_WORK
|| err
== ENAMETOOLONG
)
408 static char const nonce_base
[] = ".#-emacsXXXXXX";
409 char *last_slash
= strrchr (lfname
, '/');
410 ptrdiff_t lfdirlen
= last_slash
+ 1 - lfname
;
412 char *nonce
= SAFE_ALLOCA (lfdirlen
+ sizeof nonce_base
);
415 mode_t world_readable
= S_IRUSR
| S_IRGRP
| S_IROTH
;
416 memcpy (nonce
, lfname
, lfdirlen
);
417 strcpy (nonce
+ lfdirlen
, nonce_base
);
420 /* Prefer mkstemp if available, as it avoids a race between
421 mktemp and emacs_open. */
422 fd
= mkstemp (nonce
);
426 fd
= emacs_open (nonce
, O_WRONLY
| O_CREAT
| O_EXCL
| O_BINARY
,
435 ptrdiff_t lock_info_len
= strlen (lock_info_str
);
437 if (emacs_write (fd
, lock_info_str
, lock_info_len
) != lock_info_len
438 || (need_fchmod
&& fchmod (fd
, world_readable
) != 0))
440 if (emacs_close (fd
) != 0)
442 if (!err
&& rename_lock_file (nonce
, lfname
, force
) != 0)
454 /* Lock the lock file named LFNAME.
455 If FORCE, do so even if it is already locked.
456 Return 0 if successful, an error number on failure. */
459 lock_file_1 (char *lfname
, bool force
)
461 /* Call this first because it can GC. */
462 printmax_t boot
= get_boot_time ();
464 Lisp_Object luser_name
= Fuser_login_name (Qnil
);
465 char const *user_name
= STRINGP (luser_name
) ? SSDATA (luser_name
) : "";
466 Lisp_Object lhost_name
= Fsystem_name ();
467 char const *host_name
= STRINGP (lhost_name
) ? SSDATA (lhost_name
) : "";
468 char lock_info_str
[MAX_LFINFO
+ 1];
469 printmax_t pid
= getpid ();
471 if (sizeof lock_info_str
472 <= snprintf (lock_info_str
, sizeof lock_info_str
,
473 boot
? "%s@%s.%"pMd
":%"pMd
: "%s@%s.%"pMd
,
474 user_name
, host_name
, pid
, boot
))
477 return create_lock_file (lfname
, lock_info_str
, force
);
480 /* Return true if times A and B are no more than one second apart. */
483 within_one_second (time_t a
, time_t b
)
485 return (a
- b
>= -1 && a
- b
<= 1);
488 /* On systems lacking ELOOP, test for an errno value that shouldn't occur. */
493 /* Read the data for the lock file LFNAME into LFINFO. Read at most
494 MAX_LFINFO + 1 bytes. Return the number of bytes read, or -1
495 (setting errno) on error. */
498 read_lock_data (char *lfname
, char lfinfo
[MAX_LFINFO
+ 1])
502 while ((nbytes
= readlinkat (AT_FDCWD
, lfname
, lfinfo
, MAX_LFINFO
+ 1)) < 0
505 int fd
= emacs_open (lfname
, O_RDONLY
| O_BINARY
| O_NOFOLLOW
, 0);
508 ptrdiff_t read_bytes
= emacs_read (fd
, lfinfo
, MAX_LFINFO
+ 1);
509 int read_errno
= errno
;
510 if (emacs_close (fd
) != 0)
519 /* readlinkat saw a non-symlink, but emacs_open saw a symlink.
520 The former must have been removed and replaced by the latter.
528 /* Return 0 if nobody owns the lock file LFNAME or the lock is obsolete,
529 1 if another process owns it (and set OWNER (if non-null) to info),
530 2 if the current process owns it,
531 or -1 if something is wrong with the locking mechanism. */
534 current_lock_owner (lock_info_type
*owner
, char *lfname
)
537 lock_info_type local_owner
;
539 intmax_t pid
, boot_time
;
540 char *at
, *dot
, *lfinfo_end
;
542 /* Even if the caller doesn't want the owner info, we still have to
543 read it to determine return value. */
545 owner
= &local_owner
;
547 /* If nonexistent lock file, all is well; otherwise, got strange error. */
548 lfinfolen
= read_lock_data (lfname
, owner
->user
);
550 return errno
== ENOENT
? 0 : -1;
551 if (MAX_LFINFO
< lfinfolen
)
553 owner
->user
[lfinfolen
] = 0;
555 /* Parse USER@HOST.PID:BOOT_TIME. If can't parse, return -1. */
556 /* The USER is everything before the last @. */
557 owner
->at
= at
= memrchr (owner
->user
, '@', lfinfolen
);
560 owner
->dot
= dot
= strrchr (at
, '.');
564 /* The PID is everything from the last `.' to the `:'. */
565 if (! c_isdigit (dot
[1]))
568 pid
= strtoimax (dot
+ 1, &owner
->colon
, 10);
572 /* After the `:', if there is one, comes the boot time. */
573 switch (owner
->colon
[0])
577 lfinfo_end
= owner
->colon
;
581 if (! c_isdigit (owner
->colon
[1]))
583 boot_time
= strtoimax (owner
->colon
+ 1, &lfinfo_end
, 10);
589 if (lfinfo_end
!= owner
->user
+ lfinfolen
)
592 /* On current host? */
593 if (STRINGP (Vsystem_name
)
594 && dot
- (at
+ 1) == SBYTES (Vsystem_name
)
595 && memcmp (at
+ 1, SSDATA (Vsystem_name
), SBYTES (Vsystem_name
)) == 0)
597 if (pid
== getpid ())
598 ret
= 2; /* We own it. */
599 else if (0 < pid
&& pid
<= TYPE_MAXIMUM (pid_t
)
600 && (kill (pid
, 0) >= 0 || errno
== EPERM
)
602 || (boot_time
<= TYPE_MAXIMUM (time_t)
603 && within_one_second (boot_time
, get_boot_time ()))))
604 ret
= 1; /* An existing process on this machine owns it. */
605 /* The owner process is dead or has a strange pid, so try to
608 return unlink (lfname
);
611 { /* If we wanted to support the check for stale locks on remote machines,
612 here's where we'd do it. */
620 /* Lock the lock named LFNAME if possible.
621 Return 0 in that case.
622 Return positive if some other process owns the lock, and info about
623 that process in CLASHER.
624 Return -1 if cannot lock for any other reason. */
627 lock_if_free (lock_info_type
*clasher
, char *lfname
)
630 while ((err
= lock_file_1 (lfname
, 0)) == EEXIST
)
632 switch (current_lock_owner (clasher
, lfname
))
635 return 0; /* We ourselves locked it. */
637 return 1; /* Someone else has it. */
639 return -1; /* current_lock_owner returned strange error. */
642 /* We deleted a stale lock; try again to lock the file. */
648 /* lock_file locks file FN,
649 meaning it serves notice on the world that you intend to edit that file.
650 This should be done only when about to modify a file-visiting
651 buffer previously unmodified.
652 Do not (normally) call this for a buffer already modified,
653 as either the file is already locked, or the user has already
654 decided to go ahead without locking.
656 When this returns, either the lock is locked for us,
657 or lock creation failed,
658 or the user has said to go ahead without locking.
660 If the file is locked by someone else, this calls
661 ask-user-about-lock (a Lisp function) with two arguments,
662 the file name and info about the user who did the locking.
663 This function can signal an error, or return t meaning
664 take away the lock, or return nil meaning ignore the lock. */
667 lock_file (Lisp_Object fn
)
669 Lisp_Object orig_fn
, encoded_fn
;
671 lock_info_type lock_info
;
675 /* Don't do locking if the user has opted out. */
676 if (! create_lockfiles
)
679 /* Don't do locking while dumping Emacs.
680 Uncompressing wtmp files uses call-process, which does not work
681 in an uninitialized Emacs. */
682 if (! NILP (Vpurify_flag
))
687 fn
= Fexpand_file_name (fn
, Qnil
);
689 /* Ensure we have only '/' separators, to avoid problems with
690 looking (inside fill_in_lock_file_name) for backslashes in file
691 names encoded by some DBCS codepage. */
692 dostounix_filename (SSDATA (fn
), 1);
694 encoded_fn
= ENCODE_FILE (fn
);
696 /* Create the name of the lock-file for file fn */
697 MAKE_LOCK_NAME (lfname
, encoded_fn
);
699 /* See if this file is visited and has changed on disk since it was
702 register Lisp_Object subject_buf
;
704 subject_buf
= get_truename_buffer (orig_fn
);
706 if (!NILP (subject_buf
)
707 && NILP (Fverify_visited_file_modtime (subject_buf
))
708 && !NILP (Ffile_exists_p (fn
)))
709 call1 (intern ("ask-user-about-supersession-threat"), fn
);
713 /* Try to lock the lock. */
714 if (0 < lock_if_free (&lock_info
, lfname
))
716 /* Someone else has the lock. Consider breaking it. */
718 char *dot
= lock_info
.dot
;
719 ptrdiff_t pidlen
= lock_info
.colon
- (dot
+ 1);
720 static char const replacement
[] = " (pid ";
721 int replacementlen
= sizeof replacement
- 1;
722 memmove (dot
+ replacementlen
, dot
+ 1, pidlen
);
723 strcpy (dot
+ replacementlen
+ pidlen
, ")");
724 memcpy (dot
, replacement
, replacementlen
);
725 attack
= call2 (intern ("ask-user-about-lock"), fn
,
726 build_string (lock_info
.user
));
727 /* Take the lock if the user said so. */
729 lock_file_1 (lfname
, 1);
737 unlock_file (Lisp_Object fn
)
742 fn
= Fexpand_file_name (fn
, Qnil
);
743 fn
= ENCODE_FILE (fn
);
745 MAKE_LOCK_NAME (lfname
, fn
);
747 if (current_lock_owner (0, lfname
) == 2)
754 unlock_all_files (void)
756 register Lisp_Object tail
;
757 register struct buffer
*b
;
759 for (tail
= Vbuffer_alist
; CONSP (tail
); tail
= XCDR (tail
))
761 b
= XBUFFER (XCDR (XCAR (tail
)));
762 if (STRINGP (BVAR (b
, file_truename
)) && BUF_SAVE_MODIFF (b
) < BUF_MODIFF (b
))
764 unlock_file (BVAR (b
, file_truename
));
769 DEFUN ("lock-buffer", Flock_buffer
, Slock_buffer
,
771 doc
: /* Lock FILE, if current buffer is modified.
772 FILE defaults to current buffer's visited file,
773 or else nothing is done if current buffer isn't visiting a file. */)
777 file
= BVAR (current_buffer
, file_truename
);
780 if (SAVE_MODIFF
< MODIFF
786 DEFUN ("unlock-buffer", Funlock_buffer
, Sunlock_buffer
,
788 doc
: /* Unlock the file visited in the current buffer.
789 If the buffer is not modified, this does nothing because the file
790 should not be locked in that case. */)
793 if (SAVE_MODIFF
< MODIFF
794 && STRINGP (BVAR (current_buffer
, file_truename
)))
795 unlock_file (BVAR (current_buffer
, file_truename
));
799 /* Unlock the file visited in buffer BUFFER. */
802 unlock_buffer (struct buffer
*buffer
)
804 if (BUF_SAVE_MODIFF (buffer
) < BUF_MODIFF (buffer
)
805 && STRINGP (BVAR (buffer
, file_truename
)))
806 unlock_file (BVAR (buffer
, file_truename
));
809 DEFUN ("file-locked-p", Ffile_locked_p
, Sfile_locked_p
, 1, 1, 0,
810 doc
: /* Return a value indicating whether FILENAME is locked.
811 The value is nil if the FILENAME is not locked,
812 t if it is locked by you, else a string saying which user has locked it. */)
813 (Lisp_Object filename
)
818 lock_info_type locker
;
821 filename
= Fexpand_file_name (filename
, Qnil
);
823 MAKE_LOCK_NAME (lfname
, filename
);
825 owner
= current_lock_owner (&locker
, lfname
);
831 ret
= make_string (locker
.user
, locker
.at
- locker
.user
);
837 #endif /* CLASH_DETECTION */
840 syms_of_filelock (void)
842 DEFVAR_LISP ("temporary-file-directory", Vtemporary_file_directory
,
843 doc
: /* The directory for writing temporary files. */);
844 Vtemporary_file_directory
= Qnil
;
846 DEFVAR_BOOL ("create-lockfiles", create_lockfiles
,
847 doc
: /* Non-nil means use lockfiles to avoid editing collisions. */);
848 create_lockfiles
= 1;
850 #ifdef CLASH_DETECTION
851 defsubr (&Sunlock_buffer
);
852 defsubr (&Slock_buffer
);
853 defsubr (&Sfile_locked_p
);