Filesystem races and check-use separation

Mechanism

A time-of-check/time-of-use race occurs when a security decision uses one object state and the later operation acts on a changed state. Filesystem paths are especially vulnerable because directory entries and symlinks can change between validation and open. Faster looping alone does not explain the primitive.

Practical method

Draw the sequence of validation, path resolution, opening, and mutation. Identify what the attacker can change between steps. Build a deterministic local harness with synchronization to demonstrate the race before relying on repeated attempts. Compare path-based access with descriptor-relative operations.

check path -> attacker replaces directory entry -> open path
             validated object and opened object differ

Interpreting evidence

Record the object identifiers observed at check and use. A correct proof shows the operation occurred on a different object under the original authorization decision.

Pitfalls and limits

Atomic rename changes directory entries but not existing descriptors. Symlink checks can race too. O_NOFOLLOW constrains the final component but does not alone solve every ancestor-path issue.