1 /* Lock files for editing.
3 Copyright (C) 1985-1987, 1993-1994, 1996, 1998-2016 Free Software
7 (according to authors.el)
9 This file is part of GNU Emacs.
11 GNU Emacs is free software: you can redistribute it and/or modify
12 it under the terms of the GNU General Public License as published by
13 the Free Software Foundation, either version 3 of the License, or
14 (at your option) any later version.
16 GNU Emacs is distributed in the hope that it will be useful,
17 but WITHOUT ANY WARRANTY; without even the implied warranty of
18 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 GNU General Public License for more details.
21 You should have received a copy of the GNU General Public License
22 along with GNU Emacs. If not, see <http://www.gnu.org/licenses/>. */
26 #include <sys/types.h>
40 #include <sys/sysctl.h>
41 #endif /* __FreeBSD__ */
52 #include <sys/socket.h> /* for fcntl */
53 #include "w32.h" /* for dostounix_filename */
60 /* A file whose last-modified time is just after the most recent boot.
61 Define this to be NULL to disable checking for this file. */
62 #ifndef BOOT_TIME_FILE
63 #define BOOT_TIME_FILE "/var/run/random-seed"
67 #define WTMP_FILE "/var/log/wtmp"
70 /* Normally use a symbolic link to represent a lock.
71 The strategy: to lock a file FN, create a symlink .#FN in FN's
72 directory, with link data `user@host.pid'. This avoids a single
73 mount (== failure) point for lock files.
75 When the host in the lock data is the current host, we can check if
76 the pid is valid with kill.
78 Otherwise, we could look at a separate file that maps hostnames to
79 reboot times to see if the remote pid can possibly be valid, since we
80 don't want Emacs to have to communicate via pipes or sockets or
81 whatever to other processes, either locally or remotely; rms says
82 that's too unreliable. Hence the separate file, which could
83 theoretically be updated by daemons running separately -- but this
84 whole idea is unimplemented; in practice, at least in our
85 environment, it seems such stale locks arise fairly infrequently, and
86 Emacs' standard methods of dealing with clashes suffice.
88 We use symlinks instead of normal files because (1) they can be
89 stored more efficiently on the filesystem, since the kernel knows
90 they will be small, and (2) all the info about the lock can be read
91 in a single system call (readlink). Although we could use regular
92 files to be useful on old systems lacking symlinks, nowadays
93 virtually all such systems are probably single-user anyway, so it
94 didn't seem worth the complication.
96 Similarly, we don't worry about a possible 14-character limit on
97 file names, because those are all the same systems that don't have
100 This is compatible with the locking scheme used by Interleaf (which
101 has contributed this implementation for Emacs), and was designed by
102 Ethan Jacobson, Kimbo Mundy, and others.
104 --karl@cs.umb.edu/karl@hq.ileaf.com.
106 On some file systems, notably those of MS-Windows, symbolic links
107 do not work well, so instead of a symlink .#FN -> 'user@host.pid',
108 the lock is a regular file .#FN with contents 'user@host.pid'. To
109 establish a lock, a nonce file is created and then renamed to .#FN.
110 On MS-Windows this renaming is atomic unless the lock is forcibly
111 acquired. On other systems the renaming is atomic if the lock is
112 forcibly acquired; if not, the renaming is done via hard links,
113 which is good enough for lock-file purposes.
115 To summarize, race conditions can occur with either:
117 * Forced locks on MS-Windows systems.
119 * Non-forced locks on non-MS-Windows systems that support neither
120 hard nor symbolic links. */
123 /* Return the time of the last system boot. */
125 static time_t boot_time
;
126 static bool boot_time_initialized
;
129 static void get_boot_time_1 (const char *, bool);
135 #if defined (BOOT_TIME)
139 if (boot_time_initialized
)
141 boot_time_initialized
= 1;
143 #if defined (CTL_KERN) && defined (KERN_BOOTTIME)
147 struct timeval boottime_val
;
150 mib
[1] = KERN_BOOTTIME
;
151 size
= sizeof (boottime_val
);
153 if (sysctl (mib
, 2, &boottime_val
, &size
, NULL
, 0) >= 0)
155 boot_time
= boottime_val
.tv_sec
;
159 #endif /* defined (CTL_KERN) && defined (KERN_BOOTTIME) */
164 if (stat (BOOT_TIME_FILE
, &st
) == 0)
166 boot_time
= st
.st_mtime
;
171 #if defined (BOOT_TIME)
173 /* The utmp routines maintain static state.
174 Don't touch that state unless we are initialized,
175 since it might not survive dumping. */
178 #endif /* not CANNOT_DUMP */
180 /* Try to get boot time from utmp before wtmp,
181 since utmp is typically much smaller than wtmp.
182 Passing a null pointer causes get_boot_time_1
183 to inspect the default file, namely utmp. */
184 get_boot_time_1 (0, 0);
188 /* Try to get boot time from the current wtmp file. */
189 get_boot_time_1 (WTMP_FILE
, 1);
191 /* If we did not find a boot time in wtmp, look at wtmp, and so on. */
192 for (counter
= 0; counter
< 20 && ! boot_time
; counter
++)
194 char cmd_string
[sizeof WTMP_FILE
".19.gz"];
195 Lisp_Object tempname
, filename
;
196 bool delete_flag
= 0;
200 tempname
= make_formatted_string
201 (cmd_string
, "%s.%d", WTMP_FILE
, counter
);
202 if (! NILP (Ffile_exists_p (tempname
)))
206 tempname
= make_formatted_string (cmd_string
, "%s.%d.gz",
208 if (! NILP (Ffile_exists_p (tempname
)))
210 /* The utmp functions on mescaline.gnu.org accept only
211 file names up to 8 characters long. Choose a 2
212 character long prefix, and call make_temp_file with
213 second arg non-zero, so that it will add not more
214 than 6 characters to the prefix. */
215 filename
= Fexpand_file_name (build_string ("wt"),
216 Vtemporary_file_directory
);
217 filename
= make_temp_name (filename
, 1);
218 CALLN (Fcall_process
, build_string ("gzip"), Qnil
,
219 list2 (QCfile
, filename
), Qnil
,
220 build_string ("-cd"), tempname
);
225 if (! NILP (filename
))
227 get_boot_time_1 (SSDATA (filename
), 1);
229 unlink (SSDATA (filename
));
240 /* Try to get the boot time from wtmp file FILENAME.
241 This succeeds if that file contains a reboot record.
243 If FILENAME is zero, use the same file as before;
244 if no FILENAME has ever been specified, this is the utmp file.
245 Use the newest reboot record if NEWEST,
246 the first reboot record otherwise.
247 Ignore all reboot records on or before BOOT_TIME.
248 Success is indicated by setting BOOT_TIME to a larger value. */
251 get_boot_time_1 (const char *filename
, bool newest
)
253 struct utmp ut
, *utp
;
257 /* On some versions of IRIX, opening a nonexistent file name
258 is likely to crash in the utmp routines. */
259 if (faccessat (AT_FDCWD
, filename
, R_OK
, AT_EACCESS
) != 0)
269 /* Find the next reboot record. */
270 ut
.ut_type
= BOOT_TIME
;
274 /* Compare reboot times and use the newest one. */
275 if (utp
->ut_time
> boot_time
)
277 boot_time
= utp
->ut_time
;
281 /* Advance on element in the file
282 so that getutid won't repeat the same one. */
289 #endif /* BOOT_TIME */
291 /* An arbitrary limit on lock contents length. 8 K should be plenty
292 big enough in practice. */
293 enum { MAX_LFINFO
= 8 * 1024 };
295 /* Here is the structure that stores information about a lock. */
299 /* Location of '@', '.', ':' in USER. If there's no colon, COLON
300 points to the end of USER. */
301 char *at
, *dot
, *colon
;
303 /* Lock file contents USER@HOST.PID with an optional :BOOT_TIME
304 appended. This memory is used as a lock file contents buffer, so
305 it needs room for MAX_LFINFO + 1 bytes. A string " (pid NNNN)"
306 may be appended to the USER@HOST while generating a diagnostic,
307 so make room for its extra bytes (as opposed to ".NNNN") too. */
308 char user
[MAX_LFINFO
+ 1 + sizeof " (pid )" - sizeof "."];
311 /* Write the name of the lock file for FNAME into LOCKNAME. Length
312 will be that of FNAME plus two more for the leading ".#", plus one
314 #define MAKE_LOCK_NAME(lockname, fname) \
315 (lockname = SAFE_ALLOCA (SBYTES (fname) + 2 + 1), \
316 fill_in_lock_file_name (lockname, fname))
319 fill_in_lock_file_name (char *lockfile
, Lisp_Object fn
)
321 char *last_slash
= memrchr (SSDATA (fn
), '/', SBYTES (fn
));
322 char *base
= last_slash
+ 1;
323 ptrdiff_t dirlen
= base
- SSDATA (fn
);
324 memcpy (lockfile
, SSDATA (fn
), dirlen
);
325 lockfile
[dirlen
] = '.';
326 lockfile
[dirlen
+ 1] = '#';
327 strcpy (lockfile
+ dirlen
+ 2, base
);
330 /* For some reason Linux kernels return EPERM on file systems that do
331 not support hard or symbolic links. This symbol documents the quirk.
332 There is no way to tell whether a symlink call fails due to
333 permissions issues or because links are not supported, but luckily
334 the lock file code should work either way. */
335 enum { LINKS_MIGHT_NOT_WORK
= EPERM
};
337 /* Rename OLD to NEW. If FORCE, replace any existing NEW.
338 It is OK if there are temporarily two hard links to OLD.
339 Return 0 if successful, -1 (setting errno) otherwise. */
341 rename_lock_file (char const *old
, char const *new, bool force
)
344 return sys_rename_replace (old
, new, force
);
350 if (link (old
, new) == 0)
351 return unlink (old
) == 0 || errno
== ENOENT
? 0 : -1;
352 if (errno
!= ENOSYS
&& errno
!= LINKS_MIGHT_NOT_WORK
)
355 /* 'link' does not work on this file system. This can occur on
356 a GNU/Linux host mounting a FAT32 file system. Fall back on
357 'rename' after checking that NEW does not exist. There is a
358 potential race condition since some other process may create
359 NEW immediately after the existence check, but it's the best
360 we can portably do here. */
361 if (lstat (new, &st
) == 0 || errno
== EOVERFLOW
)
370 return rename (old
, new);
374 /* Create the lock file LFNAME with contents LOCK_INFO_STR. Return 0 if
375 successful, an errno value on failure. If FORCE, remove any
376 existing LFNAME if necessary. */
379 create_lock_file (char *lfname
, char *lock_info_str
, bool force
)
382 /* Symlinks are supported only by later versions of Windows, and
383 creating them is a privileged operation that often triggers
384 User Account Control elevation prompts. Avoid the problem by
385 pretending that 'symlink' does not work. */
388 int err
= symlink (lock_info_str
, lfname
) == 0 ? 0 : errno
;
391 if (err
== EEXIST
&& force
)
394 err
= symlink (lock_info_str
, lfname
) == 0 ? 0 : errno
;
397 if (err
== ENOSYS
|| err
== LINKS_MIGHT_NOT_WORK
|| err
== ENAMETOOLONG
)
399 static char const nonce_base
[] = ".#-emacsXXXXXX";
400 char *last_slash
= strrchr (lfname
, '/');
401 ptrdiff_t lfdirlen
= last_slash
+ 1 - lfname
;
403 char *nonce
= SAFE_ALLOCA (lfdirlen
+ sizeof nonce_base
);
405 memcpy (nonce
, lfname
, lfdirlen
);
406 strcpy (nonce
+ lfdirlen
, nonce_base
);
408 fd
= mkostemp (nonce
, O_BINARY
| O_CLOEXEC
);
413 ptrdiff_t lock_info_len
;
415 fcntl (fd
, F_SETFD
, FD_CLOEXEC
);
416 lock_info_len
= strlen (lock_info_str
);
418 /* Use 'write', not 'emacs_write', as garbage collection
419 might signal an error, which would leak FD. */
420 if (write (fd
, lock_info_str
, lock_info_len
) != lock_info_len
421 || fchmod (fd
, S_IRUSR
| S_IRGRP
| S_IROTH
) != 0)
423 /* There is no need to call fsync here, as the contents of
424 the lock file need not survive system crashes. */
425 if (emacs_close (fd
) != 0)
427 if (!err
&& rename_lock_file (nonce
, lfname
, force
) != 0)
439 /* Lock the lock file named LFNAME.
440 If FORCE, do so even if it is already locked.
441 Return 0 if successful, an error number on failure. */
444 lock_file_1 (char *lfname
, bool force
)
446 /* Call this first because it can GC. */
447 printmax_t boot
= get_boot_time ();
449 Lisp_Object luser_name
= Fuser_login_name (Qnil
);
450 char const *user_name
= STRINGP (luser_name
) ? SSDATA (luser_name
) : "";
451 Lisp_Object lhost_name
= Fsystem_name ();
452 char const *host_name
= STRINGP (lhost_name
) ? SSDATA (lhost_name
) : "";
453 char lock_info_str
[MAX_LFINFO
+ 1];
454 printmax_t pid
= getpid ();
458 if (sizeof lock_info_str
459 <= snprintf (lock_info_str
, sizeof lock_info_str
,
461 user_name
, host_name
, pid
, boot
))
464 else if (sizeof lock_info_str
465 <= snprintf (lock_info_str
, sizeof lock_info_str
,
467 user_name
, host_name
, pid
))
470 return create_lock_file (lfname
, lock_info_str
, force
);
473 /* Return true if times A and B are no more than one second apart. */
476 within_one_second (time_t a
, time_t b
)
478 return (a
- b
>= -1 && a
- b
<= 1);
481 /* On systems lacking ELOOP, test for an errno value that shouldn't occur. */
486 /* Read the data for the lock file LFNAME into LFINFO. Read at most
487 MAX_LFINFO + 1 bytes. Return the number of bytes read, or -1
488 (setting errno) on error. */
491 read_lock_data (char *lfname
, char lfinfo
[MAX_LFINFO
+ 1])
495 while ((nbytes
= readlinkat (AT_FDCWD
, lfname
, lfinfo
, MAX_LFINFO
+ 1)) < 0
498 int fd
= emacs_open (lfname
, O_RDONLY
| O_BINARY
| O_NOFOLLOW
, 0);
501 /* Use read, not emacs_read, since FD isn't unwind-protected. */
502 ptrdiff_t read_bytes
= read (fd
, lfinfo
, MAX_LFINFO
+ 1);
503 int read_errno
= errno
;
504 if (emacs_close (fd
) != 0)
513 /* readlinkat saw a non-symlink, but emacs_open saw a symlink.
514 The former must have been removed and replaced by the latter.
522 /* Return 0 if nobody owns the lock file LFNAME or the lock is obsolete,
523 1 if another process owns it (and set OWNER (if non-null) to info),
524 2 if the current process owns it,
525 or -1 if something is wrong with the locking mechanism. */
528 current_lock_owner (lock_info_type
*owner
, char *lfname
)
531 lock_info_type local_owner
;
533 intmax_t pid
, boot_time
;
534 char *at
, *dot
, *lfinfo_end
;
536 /* Even if the caller doesn't want the owner info, we still have to
537 read it to determine return value. */
539 owner
= &local_owner
;
541 /* If nonexistent lock file, all is well; otherwise, got strange error. */
542 lfinfolen
= read_lock_data (lfname
, owner
->user
);
544 return errno
== ENOENT
? 0 : -1;
545 if (MAX_LFINFO
< lfinfolen
)
547 owner
->user
[lfinfolen
] = 0;
549 /* Parse USER@HOST.PID:BOOT_TIME. If can't parse, return -1. */
550 /* The USER is everything before the last @. */
551 owner
->at
= at
= memrchr (owner
->user
, '@', lfinfolen
);
554 owner
->dot
= dot
= strrchr (at
, '.');
558 /* The PID is everything from the last `.' to the `:'. */
559 if (! c_isdigit (dot
[1]))
562 pid
= strtoimax (dot
+ 1, &owner
->colon
, 10);
566 /* After the `:', if there is one, comes the boot time. */
567 switch (owner
->colon
[0])
571 lfinfo_end
= owner
->colon
;
575 if (! c_isdigit (owner
->colon
[1]))
577 boot_time
= strtoimax (owner
->colon
+ 1, &lfinfo_end
, 10);
583 if (lfinfo_end
!= owner
->user
+ lfinfolen
)
586 /* On current host? */
587 Lisp_Object system_name
= Fsystem_name ();
588 if (STRINGP (system_name
)
589 && dot
- (at
+ 1) == SBYTES (system_name
)
590 && memcmp (at
+ 1, SSDATA (system_name
), SBYTES (system_name
)) == 0)
592 if (pid
== getpid ())
593 ret
= 2; /* We own it. */
594 else if (0 < pid
&& pid
<= TYPE_MAXIMUM (pid_t
)
595 && (kill (pid
, 0) >= 0 || errno
== EPERM
)
597 || (boot_time
<= TYPE_MAXIMUM (time_t)
598 && within_one_second (boot_time
, get_boot_time ()))))
599 ret
= 1; /* An existing process on this machine owns it. */
600 /* The owner process is dead or has a strange pid, so try to
603 return unlink (lfname
);
606 { /* If we wanted to support the check for stale locks on remote machines,
607 here's where we'd do it. */
615 /* Lock the lock named LFNAME if possible.
616 Return 0 in that case.
617 Return positive if some other process owns the lock, and info about
618 that process in CLASHER.
619 Return -1 if cannot lock for any other reason. */
622 lock_if_free (lock_info_type
*clasher
, char *lfname
)
625 while ((err
= lock_file_1 (lfname
, 0)) == EEXIST
)
627 switch (current_lock_owner (clasher
, lfname
))
630 return 0; /* We ourselves locked it. */
632 return 1; /* Someone else has it. */
634 return -1; /* current_lock_owner returned strange error. */
637 /* We deleted a stale lock; try again to lock the file. */
643 /* lock_file locks file FN,
644 meaning it serves notice on the world that you intend to edit that file.
645 This should be done only when about to modify a file-visiting
646 buffer previously unmodified.
647 Do not (normally) call this for a buffer already modified,
648 as either the file is already locked, or the user has already
649 decided to go ahead without locking.
651 When this returns, either the lock is locked for us,
652 or lock creation failed,
653 or the user has said to go ahead without locking.
655 If the file is locked by someone else, this calls
656 ask-user-about-lock (a Lisp function) with two arguments,
657 the file name and info about the user who did the locking.
658 This function can signal an error, or return t meaning
659 take away the lock, or return nil meaning ignore the lock. */
662 lock_file (Lisp_Object fn
)
664 Lisp_Object orig_fn
, encoded_fn
;
666 lock_info_type lock_info
;
669 /* Don't do locking while dumping Emacs.
670 Uncompressing wtmp files uses call-process, which does not work
671 in an uninitialized Emacs. */
672 if (! NILP (Vpurify_flag
))
676 fn
= Fexpand_file_name (fn
, Qnil
);
678 /* Ensure we have only '/' separators, to avoid problems with
679 looking (inside fill_in_lock_file_name) for backslashes in file
680 names encoded by some DBCS codepage. */
681 dostounix_filename (SSDATA (fn
));
683 encoded_fn
= ENCODE_FILE (fn
);
685 /* See if this file is visited and has changed on disk since it was
688 register Lisp_Object subject_buf
;
690 subject_buf
= get_truename_buffer (orig_fn
);
692 if (!NILP (subject_buf
)
693 && NILP (Fverify_visited_file_modtime (subject_buf
))
694 && !NILP (Ffile_exists_p (fn
)))
695 call1 (intern ("ask-user-about-supersession-threat"), fn
);
699 /* Don't do locking if the user has opted out. */
700 if (create_lockfiles
)
703 /* Create the name of the lock-file for file fn */
704 MAKE_LOCK_NAME (lfname
, encoded_fn
);
706 /* Try to lock the lock. */
707 if (0 < lock_if_free (&lock_info
, lfname
))
709 /* Someone else has the lock. Consider breaking it. */
711 char *dot
= lock_info
.dot
;
712 ptrdiff_t pidlen
= lock_info
.colon
- (dot
+ 1);
713 static char const replacement
[] = " (pid ";
714 int replacementlen
= sizeof replacement
- 1;
715 memmove (dot
+ replacementlen
, dot
+ 1, pidlen
);
716 strcpy (dot
+ replacementlen
+ pidlen
, ")");
717 memcpy (dot
, replacement
, replacementlen
);
718 attack
= call2 (intern ("ask-user-about-lock"), fn
,
719 build_string (lock_info
.user
));
720 /* Take the lock if the user said so. */
722 lock_file_1 (lfname
, 1);
729 unlock_file (Lisp_Object fn
)
734 fn
= Fexpand_file_name (fn
, Qnil
);
735 fn
= ENCODE_FILE (fn
);
737 MAKE_LOCK_NAME (lfname
, fn
);
739 if (current_lock_owner (0, lfname
) == 2)
746 unlock_all_files (void)
748 register Lisp_Object tail
, buf
;
749 register struct buffer
*b
;
751 FOR_EACH_LIVE_BUFFER (tail
, buf
)
754 if (STRINGP (BVAR (b
, file_truename
))
755 && BUF_SAVE_MODIFF (b
) < BUF_MODIFF (b
))
756 unlock_file (BVAR (b
, file_truename
));
760 DEFUN ("lock-buffer", Flock_buffer
, Slock_buffer
,
762 doc
: /* Lock FILE, if current buffer is modified.
763 FILE defaults to current buffer's visited file,
764 or else nothing is done if current buffer isn't visiting a file.
766 If the option `create-lockfiles' is nil, this does nothing. */)
770 file
= BVAR (current_buffer
, file_truename
);
773 if (SAVE_MODIFF
< MODIFF
779 DEFUN ("unlock-buffer", Funlock_buffer
, Sunlock_buffer
,
781 doc
: /* Unlock the file visited in the current buffer.
782 If the buffer is not modified, this does nothing because the file
783 should not be locked in that case. */)
786 if (SAVE_MODIFF
< MODIFF
787 && STRINGP (BVAR (current_buffer
, file_truename
)))
788 unlock_file (BVAR (current_buffer
, file_truename
));
792 /* Unlock the file visited in buffer BUFFER. */
795 unlock_buffer (struct buffer
*buffer
)
797 if (BUF_SAVE_MODIFF (buffer
) < BUF_MODIFF (buffer
)
798 && STRINGP (BVAR (buffer
, file_truename
)))
799 unlock_file (BVAR (buffer
, file_truename
));
802 DEFUN ("file-locked-p", Ffile_locked_p
, Sfile_locked_p
, 1, 1, 0,
803 doc
: /* Return a value indicating whether FILENAME is locked.
804 The value is nil if the FILENAME is not locked,
805 t if it is locked by you, else a string saying which user has locked it. */)
806 (Lisp_Object filename
)
811 lock_info_type locker
;
814 filename
= Fexpand_file_name (filename
, Qnil
);
816 MAKE_LOCK_NAME (lfname
, filename
);
818 owner
= current_lock_owner (&locker
, lfname
);
824 ret
= make_string (locker
.user
, locker
.at
- locker
.user
);
831 syms_of_filelock (void)
833 DEFVAR_LISP ("temporary-file-directory", Vtemporary_file_directory
,
834 doc
: /* The directory for writing temporary files. */);
835 Vtemporary_file_directory
= Qnil
;
837 DEFVAR_BOOL ("create-lockfiles", create_lockfiles
,
838 doc
: /* Non-nil means use lockfiles to avoid editing collisions. */);
839 create_lockfiles
= 1;
841 defsubr (&Sunlock_buffer
);
842 defsubr (&Slock_buffer
);
843 defsubr (&Sfile_locked_p
);