Problem - Kevin Tafuro

Solution
Two basic types of locks exist: advisory and mandatory. Unix supports both advisory
and, to an extremely limited extent, mandatory locks, while Windows supports
only mandatory locks.
Discussion
In the following sections, we will look at the different issues for Unix and Windows.
Locking files on Unix
All modern Unix variants support advisory locks. An advisory lock is a lock in which
the operating system does not enforce the lock. Instead, programs sharing the same
file must cooperate with each other to ensure that locks are properly observed. From
a security perspective, advisory locks are of little use because any program is free to
perform any action on a file regardless of the state of any advisory locks that other
programs may hold on the file.
Support for mandatory locks varies greatly from one Unix variant to another. Both
Linux and Solaris support mandatory locks, but Darwin, FreeBSD, NetBSD, and
OpenBSD do not, even though they export the interface used by Linux and Solaris to
support them. On such systems, this interface creates advisory locks.
Support for mandatory locking does not extend to NFS. In other words, both Linux
and Solaris are capable only of using mandatory locks on local filesystems. Further,
Linux requires that filesystems be mounted with support for mandatory locking,
which is disabled by default. In the end, Solaris is really the only Unix variant on
which you can reasonably expect mandatory locking to work, and even then, relying
on mandatory locks is like playing with fire.
As if the story for mandatory locking on Unix were not bad enough already, it gets
worse. To be able to use mandatory locks on a file, the file must have the setgid bit
enabled and the group execute bit disabled in its permissions. Even if a process holds
a mandatory lock on a file, another process may remove the setgid bit from the file’s
permissions, which effectively turns the mandatory lock into an advisory lock!
Essentially, there is no such thing as a mandatory lock on Unix.
Just to add more fuel to the fire, neither Solaris nor Linux fully or properly implement
the System V defined semantics for mandatory locks, and both systems differ in
where they stray from the System V definitions. The details of the differences are not
important here. We strongly recommend that you avoid the Unix mandatory lock
debacle altogether. If you want to use advisory locking on Unix, then we recommend
using a standalone lock file, as described in Recipe 2.9.
58 | Chapter 2: Access Control
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.