# Re: \[RFC PATCH\] fs: introduce mkdirat2 syscall for atomic mkdir

- From: Matthew Wilcox \<willy@infradead.org\>
- Date: 2021-02-28 02:25:45 
- List: linux-api
- Page: https://ratatoskr.run/linux-api/2021/02/200746
- Thread: https://ratatoskr.run/linux-fsdevel/2021/02/200743/t.md

```text
On Sat, Feb 27, 2021 at 07:25:00PM -0500, Drew DeVault wrote:
> The mkdir and mkdirat syscalls both return 0 on success, and use of the
> newly-created directory requires a separate open or openat (or openat2)
> call. The time between these syscalls is an opportunity for a race
> condition. It is thus desirable to establish a means of creating a
> directory and returning an open dirfd for it in one atomic operation.

I don't understand what the TOCTOU race is.

$ cd /tmp
$ mkdir foo
$ sudo su fake
$ rmdir foo
rmdir: failed to remove 'foo': Operation not permitted
$ mv foo bar
mv: cannot move 'foo' to 'bar': Operation not permitted

Where's the problem?  If mkdir succeeds in a sticky directory, others
can't remove or rename it.  So how can an app be tricked into doing
something wrong?
```