Comment by hedora
5 years ago
Posix (and I think windows) guarantee this atomically and durably overwrites a file:
tempfile = mkstemp(filename-XXXX)
write(tempfile)
fsync(tempfile)
close(tempfile)
rename(tempfile, filename)
sync()
Assume the entire write failed if any of the above return an error.
In some systems (nfs and ext3 come to mind), you can skip the fsync and/or sync, but don’t do that. It doesn’t make things significantly faster on the systems where it’s safe, but it definitely will lose data on other systems.
The only loophole I know of is that the final sync can fail, then return anyway. If that happens, the file system is probably hosed anyway.
Here's the article I couldn't find before on the process https://lwn.net/Articles/457667/
Which links full source for the process you described https://lwn.net/Articles/457672/
You need a recovery step on startup to retry the rename if tempfile is complete, or delete it if it isn't.
That means you need a way to verify that tempfile is complete. I do that by removing filename after completing tempfile. And that requires a placeholder for filename if it didn't already exist (e.g. a symlink to nowhwere).
On crash, rename may leave both files in place.
This technique doesn't work if you have hardlinks to filename which should refer to the new file.
Regardless of whether the tempfile is complete, you can just ignore (or delete) it on startup. From the caller's perspective, the save operation doesn't succeed until the rename is done and written to disk.