Page History

Invoking remove() on an open file is implementation-defined. Removing an open file is sometimes recommended to hide the names of temporary files that may be prone to attack. (See rule FIO43 FIO21-C. Do not create temporary files in shared directories.)

In cases requiring the removal of an open file, a more strongly defined function, such as the POSIX unlink() function, should be considered. To be strictly conforming and portable, remove() should not be called on an open file.

Noncompliant Code Example

The following This noncompliant code example shows a case where a file is removed while it is still open.:

char *file_name;
FILE *file;

/* initializeInitialize file_name */

file = fopen(file_name, "w+");
if (file == NULL) {
  /* Handle error condition */
}

/* ... */

if (remove(file_name) != 0) {
  /* Handle error condition */
}

/* continueContinue performing I/O operations on file */

fclose(file);

...

Implementation Details

Code compiled using Microsoft Visual Studio C++ 2005 and run on compiled for Microsoft Windows XP prevents the remove() call from succeeding when the file is open, meaning that the file link will remain after execution completes.

Compliant Solution (POSIX)

Wiki MarkupThis compliant solution uses the POSIX {{unlink()}} function to remove the file. The {{unlink()}} function is guaranteed to unlink the file from the file system hierarchy but keep the file on disk until all open instances of the file are closed \[[Open Group 2004|AA. Bibliography#Open Group 04]\][IEEE Std 1003.1:2013].

FILE *file;
char *file_name;

/* initializeInitialize file_name */

file = fopen(file_name, "w+");
if (file == NULL) {
  /* Handle error condition */
}

if (unlink(file_name) != 0) {
  /* Handle error condition */
}

/*... continueContinue performing I/O operations on file ...*/

fclose(file);

Note that there is a race window between the fopen() call and the unlink() call, which could be exploited. This exploitation can be mitigated if the operations occur in a secure directory; see FIO45-C. Avoid TOCTOU race conditions while accessing files for more information.

Risk Assessment

Calling remove() on an open file has different implications for different implementations and may cause abnormal termination if the removed file is written to or read from, or it may result in unintended information disclosure from files not deleted as intended.

Automated Detection

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Related Guidelines

...

...

...

Bibliography

...

[IEEE Std 1003.1:2013]

unlink()

...

Image Added Image Added

\[[Open Group 2004|AA. Bibliography#Open Group 04]\] [{{unlink()}}|http://www.opengroup.org/onlinepubs/000095399/functions/unlink.html]

FIO07-C. Prefer fseek() to rewind()      09. Input Output (FIO)      Image Modified