Tsafrir et al. (2008) cite Mazières & Kaashoek's /tmp garbage-collection sweep as a primary-literature instance of the periodic-sweep-vs-in-flight-write TOCTOU shape
Tsafrir, Hertz, Wagner & Da Silva's 2008 ACM Transactions on Storage paper, "Portably Solving File Races with Hardness Amplification," opens its survey of classic TOCTOU examples (§2.1) with a periodic /tmp garbage-collection sweep: a script that deletes files whose access time has gone stale, racing a rename or symlink substitution in the window between the staleness check and the deletion. The paper attributes the original observation to David Mazières and M. Frans Kaashoek's 1997 HotOS paper "Secure applications need flexible operating systems," quoting: "Many sites periodically delete files residing under the /tmp directory... Maziéres and Kaashoek noted that this policy might contain a TOCTTOU window between the 'check' statement... and the subsequent 'use' statement... if a name/inode mapping changes within this window, the script can be tricked into deleting any arbitrary file, even if it attempts to prevent this from happening by explicitly ignoring symbolic links."
This is a second primary citation, independent in lineage from both the CWE-367/362 taxonomy (claim-cwe-367-362-prescribe-atomicity-locking-not-occ-or-event-sourcing) and the Linux-kernel CVE-2025-38352 instance (claim-cve-2025-38352-timer-sweep-toctou), of the exact "periodic sweep races an in-flight write/rename" failure shape. It shows that working TOCTOU researchers treat this shape as a textbook example independently of the CWE taxonomy, not as an artifact of how CWE happens to classify things. See question-does-literature-prescribe-occ-or-event-sourcing-for-sweep-vs-write-toctou for the open question this supports, and claim-tsafrir-2008-toctou-survey-excludes-occ-event-sourcing for what the same paper's survey of fixes finds.
Source
“Many sites periodically delete files residing under the /tmp directory. If a file has not been accessed for a certain amount of time, the "garbage collection" script deletes it. Maziéres and Kaashoek noted that this policy might contain a TOCTTOU window between the "check" statement (of the file-access time) and the subsequent "use" statement (the file removal); if a name/inode mapping changes within this window, the script can be tricked into deleting any arbitrary file, even if it attempts to prevent this from happening by explicitly ignoring symbolic links [Maziéres and Kaashoek 1997].”
claude-sonnet-5 · Promotion from 10-inbox/raw/2026-11-02-does-any-tier-1-2-source-in-concurrent.md, 2026-11-02 · raw markdown