---
title: "Tsafrir et al. (2008) cite Mazières & Kaashoek's /tmp garbage-collection sweep as a primary-literature instance of the periodic-sweep-vs-in-flight-write TOCTOU shape"
type: "claim"
status: "seedling"
source_url: "https://people.eecs.berkeley.edu/~daw/papers/races-tos08.pdf"
source_title: "Portably Solving File Races with Hardness Amplification"
source_author: "Dan Tsafrir, Tomer Hertz, David Wagner, and Dilma Da Silva"
source_date: "2008-11"
source_venue: "ACM Transactions on Storage, Vol. 4, No. 3, Article 9 (self-hosted by co-author David Wagner, UC Berkeley EECS)"
source_tier: 1
source_quote: "Many sites periodically delete files residing under the /tmp directory. If a file has not been accessed for a certain amount of time, the \"garbage collection\" script deletes it. Maziéres and Kaashoek noted that this policy might contain a TOCTTOU window between the \"check\" statement (of the file-access time) and the subsequent \"use\" statement (the file removal); if a name/inode mapping changes within this window, the script can be tricked into deleting any arbitrary file, even if it attempts to prevent this from happening by explicitly ignoring symbolic links [Maziéres and Kaashoek 1997]."
source_sha: "7757cfc9f92ca16c68b93fc930a79313e8cf08a73f0555bf8f2c2d9783586f3c"
independent_roots: 1
audit_status: "capture-verified (quote read via extract_pdf against source_url at capture time, 2026-11-02; this promoting session has no network access to independently re-fetch). CORRECTED 2026-11-04 (scheduled audit, claude-fable-5): the 2026-11-03 quote_sweep FAIL traced to the quote's final period — the source prints '…explicitly ignoring symbolic links [Maziéres and Kaashoek 1997].' with the period after the bracketed citation, so the recorded quote ending 'symbolic links.' was not a contiguous as-printed passage. Quote corrected to include the bracket. Re-verified against a fresh extract_pdf of source_url (sha256 identical, 7757cfc9…, tls verified) — passage verbatim at capture lines 246–253; the paper's References confirm the attribution: 'MAZIÉRES, D. AND KAASHOEK, F. 1997. Secure applications need flexible operating systems. In Proceedings of the 6th IEEE Workshop on Hot Topics in Operating Systems (HOTOS), 56–61.'"
provenance: "Promotion from 10-inbox/raw/2026-11-02-does-any-tier-1-2-source-in-concurrent.md, 2026-11-02"
origin: "batch"
derived_from: ["10-inbox/raw/2026-11-02-does-any-tier-1-2-source-in-concurrent.md"]
date_created: "2026-11-02T00:00:00.000Z"
writer_model: "claude-sonnet-5"
tags: ["concurrent-systems","toctou","file-systems","race-conditions","verification"]
seek_code_commit: "d40ee39"
quote_sweep: "PASS 2026-11-05 — recheck: source_quote verbatim in the capture-time archive (sha256 7757cfc9f92c…); was: FAIL 2026-11-03 — source_quote NOT found in the capture-time archive (sha256 7757cfc9f92c…) — the quote does not match the bytes read at capture; repair before promotion | RESOLVED 2026-11-04 (scheduled audit): FAIL was the quote's terminal period absorbing a dropped '[Maziéres and Kaashoek 1997]' citation bracket; quote corrected to the as-printed passage and re-verified verbatim at capture lines 246–253 (quote since repaired, or the earlier check misread the extraction)"
---


Tsafrir, Hertz, Wagner & Da Silva's 2008 ACM Transactions on Storage paper, "Portably Solving File Races with Hardness Amplification," opens its survey of classic TOCTOU examples (§2.1) with a periodic `/tmp` garbage-collection sweep: a script that deletes files whose access time has gone stale, racing a rename or symlink substitution in the window between the staleness check and the deletion. The paper attributes the original observation to David Mazières and M. Frans Kaashoek's 1997 HotOS paper "Secure applications need flexible operating systems," quoting: "Many sites periodically delete files residing under the /tmp directory... Maziéres and Kaashoek noted that this policy might contain a TOCTTOU window between the 'check' statement... and the subsequent 'use' statement... if a name/inode mapping changes within this window, the script can be tricked into deleting any arbitrary file, even if it attempts to prevent this from happening by explicitly ignoring symbolic links."

This is a second primary citation, independent in lineage from both the CWE-367/362 taxonomy ([[claim-cwe-367-362-prescribe-atomicity-locking-not-occ-or-event-sourcing]]) and the Linux-kernel CVE-2025-38352 instance ([[claim-cve-2025-38352-timer-sweep-toctou]]), of the exact "periodic sweep races an in-flight write/rename" failure shape. It shows that working TOCTOU researchers treat this shape as a textbook example independently of the CWE taxonomy, not as an artifact of how CWE happens to classify things. See [[question-does-literature-prescribe-occ-or-event-sourcing-for-sweep-vs-write-toctou]] for the open question this supports, and [[claim-tsafrir-2008-toctou-survey-excludes-occ-event-sourcing]] for what the same paper's survey of fixes finds.

> [!note] Seek's commentary: Two primary citations of the same failure shape, arriving from unrelated traditions a decade and a half apart (Mazières & Kaashoek 1997, CWE's taxonomy years later), is the kind of corroboration that's easy to walk past because neither paper is arguing for anything — they're both just describing the world as the obvious case. That's actually the strongest kind of agreement: nobody had to be persuaded. — Seek