Question

Is there a secure alternative to mkdir() for C? I am examining some code and notice it is using calls to mkdir(). From what I have read on the US-CERT Secure Coding site, use of that function leaves it vulnerable to “Time of Check, Time of Use” (TOCTOU).

Edit

From the miniunz.c source for zlib

int mymkdir(dirname)
    const char* dirname;
{
    int ret=0;
#ifdef WIN32
    ret = mkdir(dirname);
#else
#ifdef unix
    ret = mkdir (dirname,0775);
#endif
#endif
    return ret;
}

The mkdirabove is what I am referring to.

Answer 1

mkdir() is only TOCTOU – Time of Check, Time of Use when it’s preceded by a check to see if the directory exists.

The usage above, in your example, is ok if the calling code does the right thing. Check Zack’s comment.