Is there a better way than simply trying to open the file?
int exists(const char *fname)
{
FILE *file;
if ((file = fopen(fname, "r")))
{
fclose(file);
return 1;
}
return 0;
}
fopen()
/fclose()
method is that you may not be able to open a file for reading even though it exists. For example, /dev/kmem
exists, but most processes can't open it even for reading. /etc/shadow
is another such file. Of course, both stat()
and access()
rely on being able to access the directory containing the file; all bets are off if you can't do that (no execute permission on the directory containing the file).
if (file = fopen(fname, "r"))
will give a warning. Use parenthesis around statement inside the if-statement if ((file = fopen(fname, "r")))
(())
is solving the symptoms, not the problem. Just separate it into to lines; an extra line won't hurt that much. file = fopen(fname, "r");
if (file)
Look up the access()
function, found in unistd.h
. You can replace your function with
if (access(fname, F_OK) == 0) {
// file exists
} else {
// file doesn't exist
}
Under Windows (VC) unistd.h
does not exist. To make it work it is necessary to define:
#ifdef WIN32
#include <io.h>
#define F_OK 0
#define access _access
#endif
You can also use R_OK
, W_OK
, and X_OK
in place of F_OK
to check for read permission, write permission, and execute permission (respectively) rather than existence, and you can OR any of them together (i.e. check for both read and write permission using R_OK|W_OK
)
Update: Note that on Windows, you can't use W_OK
to reliably test for write permission, since the access function does not take DACLs into account. access( fname, W_OK )
may return 0 (success) because the file does not have the read-only attribute set, but you still may not have permission to write to the file.
Use stat
like this:
#include <sys/stat.h> // stat
#include <stdbool.h> // bool type
bool file_exists (char *filename) {
struct stat buffer;
return (stat (filename, &buffer) == 0);
}
and call it like this:
#include <stdio.h> // printf
int main(int ac, char **av) {
if (ac != 2)
return 1;
if (file_exists(av[1]))
printf("%s exists\n", av[1]);
else
printf("%s does not exist\n", av[1]);
return 0;
}
access()
also has problems, and there are options to use to make access()
and stat()
work with large files (bigger than 2 GB).
stat
not suffer from the same TOCTOU vulnerability as access
? (It's not clear to me that it would be better.)
stat()
and access()
suffer from the TOCTOU vulnerability (so does lstat()
, but fstat()
is safe). It depends what you're going to do based on the presence or absence of the file. Using the correct options to open()
is usually the best way of dealing with the problems, but it can be tricky formulating the right options. See also discussions on EAFP (Easier to Ask for Forgiveness than Permission) and LBYL (Look Before You Leap) -- see LBYL vs EAFP in Java, for example.
open()
the file in TOC (the open()
result then becomes the check for file-exisence), then use this descriptor in TOU. This way even if file does not exists anymore at TOU, you still can access it through file-descriptor. Its content will be kept as long as there are processes that have it opened.
Usually when you want to check if a file exists, it's because you want to create that file if it doesn't. Graeme Perrow's answer is good if you don't want to create that file, but it's vulnerable to a race condition if you do: another process could create the file in between you checking if it exists, and you actually opening it to write to it. (Don't laugh... this could have bad security implications if the file created was a symlink!)
If you want to check for existence and create the file if it doesn't exist, atomically so that there are no race conditions, then use this:
#include <fcntl.h>
#include <errno.h>
fd = open(pathname, O_CREAT | O_WRONLY | O_EXCL, S_IRUSR | S_IWUSR);
if (fd < 0) {
/* failure */
if (errno == EEXIST) {
/* the file already existed */
...
}
} else {
/* now you can use the file */
}
open(2)
(on Linux; your OS's man pages may vary), but it's rather ugly and may not be resistant to a malicious attacker.
FILE*
, you then need to use the posix method fdopen(fd,"flags")
to generate a FILE*
Yes. Use stat()
. See the man page forstat(2)
.
stat()
will fail if the file doesn't exist, otherwise most likely succeed. If it does exist, but you have no read access to the directory where it exists, it will also fail, but in that case any method will fail (how can you inspect the content of a directory you may not see according to access rights? Simply, you can't).
Oh, as someone else mentioned, you can also use access()
. However I prefer stat()
, as if the file exists it will immediately get me lots of useful information (when was it last updated, how big is it, owner and/or group that owns the file, access permissions, and so on).
access()
checks the file access permissions of a file and these are stored in in the inode for that file and are not in its directory entry (at least for all file systems that have inode-like structures). So access()
has to access the inode exactly the same way that stat()
has to access it. So what you say only holds true if you don't check for any permissions! And actually on some systems access()
is even implemented on top of stat()
(e.g. glibc on GNU Hurd does it that way), so there is no guarantee in the first place.
FILE *file;
if((file = fopen("sample.txt","r"))!=NULL)
{
// file exists
fclose(file);
}
else
{
//File not found, no memory leak since 'file' == NULL
//fclose(file) would cause an error
}
fopen()
is standard C, it's not going anywhere. It's only "deprecated" by Microsoft. Don't use fopen_s()
unless you want platform-specific, non-portable code.
You can use realpath() function.
resolved_file = realpath(file_path, NULL);
if (!resolved_keyfile) {
/*File dosn't exists*/
perror(keyfile);
return -1;
}
I think that access() function, which is found in unistd.h
is a good choice for Linux
(you can use stat too).
You can Use it like this:
#include <stdio.h>
#include <stdlib.h>
#include<unistd.h>
void fileCheck(const char *fileName);
int main (void) {
char *fileName = "/etc/sudoers";
fileCheck(fileName);
return 0;
}
void fileCheck(const char *fileName){
if(!access(fileName, F_OK )){
printf("The File %s\t was Found\n",fileName);
}else{
printf("The File %s\t not Found\n",fileName);
}
if(!access(fileName, R_OK )){
printf("The File %s\t can be read\n",fileName);
}else{
printf("The File %s\t cannot be read\n",fileName);
}
if(!access( fileName, W_OK )){
printf("The File %s\t it can be Edited\n",fileName);
}else{
printf("The File %s\t it cannot be Edited\n",fileName);
}
if(!access( fileName, X_OK )){
printf("The File %s\t is an Executable\n",fileName);
}else{
printf("The File %s\t is not an Executable\n",fileName);
}
}
And you get the following Output:
The File /etc/sudoers was Found
The File /etc/sudoers cannot be read
The File /etc/sudoers it cannot be Edited
The File /etc/sudoers is not an Executable
From the Visual C++ help, I'd tend to go with
/* ACCESS.C: This example uses _access to check the
* file named "ACCESS.C" to see if it exists and if
* writing is allowed.
*/
#include <io.h>
#include <stdio.h>
#include <stdlib.h>
void main( void )
{
/* Check for existence */
if( (_access( "ACCESS.C", 0 )) != -1 )
{
printf( "File ACCESS.C exists\n" );
/* Check for write permission */
if( (_access( "ACCESS.C", 2 )) != -1 )
printf( "File ACCESS.C has write permission\n" );
}
}
Also worth noting mode values of _access(const char *path,
int mode
)
:
00: Existence only
02: Write permission
04: Read permission
06: Read and write permission
As your fopen
could fail in situations where the file existed but could not be opened as requested.
Edit: Just read Mecki's post. stat()
does look like a neater way to go. Ho hum.
void main
?
main()
defined in the C standards, and both of them return int
. If a compiler/environment supports void main()
then it's only doing so as an unofficial extension.
Success story sharing
access()
to check for a file's existence), but in a SUID or SGID program, even that could be incorrect. If the tested file is in a directory that the real UID or real GID cannot access,access()
might report no such file when it does exist. Esoteric and improbable? Yes.