Port tempfile from libc to rustix.

Port tempfile from libc to rustix. This simplifies error handling,
string conversion, and factors out an `unsafe` block.

This updates the MSRV to 1.48, which is rustix's MSRV.

Cargo.toml

@@ -22,7 +22,7 @@ fastrand = "1.6.0"
 remove_dir_all = "0.5"
 
 [target.'cfg(any(unix, target_os = "wasi"))'.dependencies]
-libc = "0.2.27"
+rustix = "0.34.0"
 
 [target.'cfg(windows)'.dependencies.winapi]
 version = "0.3"

README.md

@@ -14,7 +14,7 @@ patterns and surprisingly difficult to implement securely).
 Usage
 -----
 
-Minimum required Rust version: 1.40.0
+Minimum required Rust version: 1.48.0
 
 Add this to your `Cargo.toml`:
 ```toml

src/file/imp/unix.rs

@@ -1,13 +1,11 @@
 use std::env;
-use std::ffi::{CString, OsStr};
+use std::ffi::OsStr;
 use std::fs::{self, File, OpenOptions};
 use std::io;
 cfg_if::cfg_if! {
     if #[cfg(not(target_os = "wasi"))] {
-        use std::os::unix::ffi::OsStrExt;
         use std::os::unix::fs::{MetadataExt, OpenOptionsExt};
     } else {
-        use std::os::wasi::ffi::OsStrExt;
         #[cfg(feature = "nightly")]
         use std::os::wasi::fs::MetadataExt;
     }
@@ -16,29 +14,7 @@ use crate::util;
 use std::path::Path;
 
 #[cfg(not(target_os = "redox"))]
-use libc::{c_char, c_int, link, rename, unlink};
-
-#[cfg(not(target_os = "redox"))]
-#[inline(always)]
-pub fn cvt_err(result: c_int) -> io::Result<c_int> {
-    if result == -1 {
-        Err(io::Error::last_os_error())
-    } else {
-        Ok(result)
-    }
-}
-
-#[cfg(target_os = "redox")]
-#[inline(always)]
-pub fn cvt_err(result: Result<usize, syscall::Error>) -> io::Result<usize> {
-    result.map_err(|err| io::Error::from_raw_os_error(err.errno))
-}
-
-// Stolen from std.
-pub fn cstr(path: &Path) -> io::Result<CString> {
-    CString::new(path.as_os_str().as_bytes())
-        .map_err(|_| io::Error::new(io::ErrorKind::InvalidInput, "path contained a null"))
-}
+use rustix::fs::{cwd, linkat, renameat, unlinkat, AtFlags};
 
 pub fn create_named(path: &Path, open_options: &mut OpenOptions) -> io::Result<File> {
     open_options.read(true).write(true).create_new(true);
@@ -70,16 +46,18 @@ fn create_unlinked(path: &Path) -> io::Result<File> {
 
 #[cfg(target_os = "linux")]
 pub fn create(dir: &Path) -> io::Result<File> {
-    use libc::{EISDIR, ENOENT, EOPNOTSUPP, O_TMPFILE};
+    use rustix::{fs::OFlags, io::Error};
     OpenOptions::new()
         .read(true)
         .write(true)
-        .custom_flags(O_TMPFILE) // do not mix with `create_new(true)`
+        .custom_flags(OFlags::TMPFILE.bits() as i32) // do not mix with `create_new(true)`
         .open(dir)
         .or_else(|e| {
-            match e.raw_os_error() {
+            match Error::from_io_error(&e) {
                 // These are the three "not supported" error codes for O_TMPFILE.
-                Some(EOPNOTSUPP) | Some(EISDIR) | Some(ENOENT) => create_unix(dir),
+                Some(Error::OPNOTSUPP) | Some(Error::ISDIR) | Some(Error::NOENT) => {
+                    create_unix(dir)
+                }
                 _ => Err(e),
             }
         })
@@ -124,25 +102,15 @@ pub fn reopen(_file: &File, _path: &Path) -> io::Result<File> {
 
 #[cfg(not(target_os = "redox"))]
 pub fn persist(old_path: &Path, new_path: &Path, overwrite: bool) -> io::Result<()> {
-    unsafe {
-        let old_path = cstr(old_path)?;
-        let new_path = cstr(new_path)?;
-        if overwrite {
-            cvt_err(rename(
-                old_path.as_ptr() as *const c_char,
-                new_path.as_ptr() as *const c_char,
-            ))?;
-        } else {
-            cvt_err(link(
-                old_path.as_ptr() as *const c_char,
-                new_path.as_ptr() as *const c_char,
-            ))?;
-            // Ignore unlink errors. Can we do better?
-            // On recent linux, we can use renameat2 to do this atomically.
-            let _ = unlink(old_path.as_ptr() as *const c_char);
-        }
-        Ok(())
+    if overwrite {
+        renameat(&cwd(), old_path, &cwd(), new_path)?;
+    } else {
+        linkat(&cwd(), old_path, &cwd(), new_path, AtFlags::empty())?;
+        // Ignore unlink errors. Can we do better?
+        // On recent linux, we can use renameat2 to do this atomically.
+        let _ = unlinkat(&cwd(), old_path, AtFlags::empty());
     }
+    Ok(())
 }
 
 #[cfg(target_os = "redox")]