Tentative File Open & Safe Save

When developing an app, saving changes that a user has made to a document
needs to be managed carefully. Simply overwriting the existing file with
the new data can cause trouble, if your app (or the system) should crash
part-way through, because then the file ends up with some part of the old
document overwritten with the new one, and so the user ends up without a
valid copy of either the old or the new version -- in effect, all their
work is lost.

A better technique is to rename any existing version of the file (e.g.
appending a suffix such as “-old”) before saving the new document under
the original file name. After the successful save of the new document, the
old version might or might not be deleted.

Alternatively, you might save the new document under the original file
name but with some temporary suffix, e.g. “-new”, added. Then use the
Linux RENAME_EXCHANGE option to the rename_at(2) call to simultaneously
rename each file to the other name -- exchanging the names of the new and
old files. After this, you can delete the file with the name ending in
“-new”, since this is now the old version.

Another technique is to do “tentative” file creation. If you open a file
with the O_TMPFILE option, then no entry is made in any directory; space
is allocated on the destination volume, but if the process terminates for
any reason without taking action to make the file permanent, it simply
disappears from the filesystem (and any space it was using is reclaimed).

Making the file permanent involves giving it an explicit name within the
destination filesystem. This is done with a linkat(2) call. But this call
requires an existing name to be linked to a new name; how do you specify
the existing name when, by design the file doesn’t have one?

In fact, Linux gives it a name, by a mechanism called a “magic symlink”.
If you look in /proc/«pid»/fd for a given process, it will show symlinks
to the files the process has open. For a file opened with the O_TMPFILE
option, this name can be used in a linkat(2) call to give the file a
“real” name -- i.e. one that exists in the regular filesystem.

Some example C code that shows how to do this linking is on the openat(2)
man page <https://manpages.debian.org/openat(2)>. I implemented a Python
version of this code in the save_tmpfile() routine in the linuxfs module
here <https://gitlab.com/ldo/python_linuxfs>.

For an example program that uses this module to demonstrate various of the
above options, see the safe_save script here
<https://gitlab.com/ldo/python_linuxfs_examples/>.