libc++: Add option to disable access to the global filesystem namespace

[ed]

Summary

Systems like FreeBSD's Capsicum and Nuxi CloudABI apply the concept of capability-based security on the way processes can interact with the filesystem API. It is no longer to interact with the VFS through calls like open(), unlink(), rename(), etc. Instead, processes are only allowed to interact with files and directories to which they have been granted access. The *at() functions can be used for this purpose.

This change adds a new config switch called _LIBCPP_HAS_NO_GLOBAL_FILESYSTEM_NAMESPACE. If set, all functionality that requires the global filesystem namespace will be disabled. More concretely:

• fstream's open() function will be removed.
• cstdio will no longer pull in fopen(), rename(), etc.
• The test suite's get_temp_file_name() will be removed. This will cause all tests that use the global filesystem namespace to break, but will at least make all the other tests run (as get_temp_file_name will not build anyway).

It is important to mention that this change will make fstream rather useless on those systems for now. Still, I'd rather not have fstream disabled entirely, as it is of course possible to come up with an extension for fstream that would allow access to local filesystem namespaces (e.g., by adding an openat() member function).

[jroelofs]

Seems reasonable to me. I think you ought to fix a few of the tests that this "breaks", and add a few *.fail.cpp ones to verify that the functions you expect to be removed have actually been removed. For example ./test/std/input.output/file.streams/c.files/cstdio.pass.cpp should have:

static_assert((std::is_same<decltype(std::fflush(fp)), int>::value), "");
#if defined(_LIBCPP_HAS_GLOBAL_FILESYSTEM_NAMESPACE)
static_assert((std::is_same<decltype(std::fopen("", "")), std::FILE*>::value), "");
static_assert((std::is_same<decltype(std::freopen("", "", fp)), std::FILE*>::value), "");
#endif
static_assert((std::is_same<decltype(std::setbuf(fp,cp)), void>::value), "");

And then I'd add a ./test/std/input.output/file.streams/c.files/no.global.filesystem.namespace/fopen.fail.cpp with:

// REQUIRES: CloudABI

#include <cstdio>

int main() {
    // fopen is not allowed on systems without the global filesystem namespace
    std::fopen("", "");
}

[ed]

In D8194#137640, @jroelofs wrote:

Seems reasonable to me. I think you ought to fix a few of the tests that this "breaks", and add a few *.fail.cpp ones to verify that the functions you expect to be removed have actually been removed. For example ./test/std/input.output/file.streams/c.files/cstdio.pass.cpp should have:

static_assert((std::is_same<decltype(std::fflush(fp)), int>::value), "");
#if defined(_LIBCPP_HAS_GLOBAL_FILESYSTEM_NAMESPACE)
static_assert((std::is_same<decltype(std::fopen("", "")), std::FILE*>::value), "");
static_assert((std::is_same<decltype(std::freopen("", "", fp)), std::FILE*>::value), "");
#endif
static_assert((std::is_same<decltype(std::setbuf(fp,cp)), void>::value), "");

And then I'd add a ./test/std/input.output/file.streams/c.files/no.global.filesystem.namespace/fopen.fail.cpp with:

// REQUIRES: CloudABI

#include <cstdio>

int main() {
    // fopen is not allowed on systems without the global filesystem namespace
    std::fopen("", "");
}

Yes, exactly! I was planning on doing something similar to what you've described. Good to see that I'm starting to get the hang of it.

So my current roadmap is to first get libc++ to build on CloudABI before I attempt to tackle the test suite. In my opinion it doesn't make sense to patch up the test suite if the tests cannot be run decently. Being able to build libc++ would be a prerequisite. Getting all the tests to pass followed by setting up a buildbot will be my next milestones.

Does that approach sound reasonable to you?

Thanks,
Ed

[ed]

Hi Jonathan,

As you proposed, I have inverted the logic. We now have a flag _LIBCPP_HAS_GLOBAL_FILESYSTEM_NAMESPACE. I temporarily added -D_LIBCPP_HAS_GLOBAL_FILESYSTEM_NAMESPACE to test/libcxx/test/config.py, so I've been able to mark all the tests that require the global filesystem namespace.

I won't add anything permanent to config.py yet. There may still be a number of other flags I'll need to add. My plan is to tailor config.py as soon as libc++ builds entirely.

[jroelofs]

I'd still like to see some test cases added (like the ones I mentioned before), as well as the changes needed to config.py, lit.site.in, CMakeLists.txt, etc. so that this can be tested on platforms that do have the global filesystem namespace. Then it should be simple to add another buildbot that checks these, without having to get a CloudABI buildbot running (I understand that's part of your plan, this keeps them from bit-rotting in the meantime).

Also, since you're basically marking everything in test/std/input.output/file.streams/fstreams/ as unsupported, it would be better to add:

test/std/input.output/file.streams/fstreams/lit.local.cfg
test/std/localization/locales/locale.convenience/conversion/conversions.buffer/lit.local.cfg

with this in them:

if 'libcpp-has-no-global-filesystem-namespace' in config.available_features:
    config.unsupported = True

rather than putting // UNSUPPORTED:s everywhere. They get yucky to maintain when other folks add new test files, and this is a mistake I made when I did the ones for the single-threaded stuff... I still need to fix that. Sorry I didn't mention this earlier.

Cheers,

Jon

[ed]

Hi Jonathan,

This is interesting. Today I spent quite some time getting lit to do what I want but it seems I'm running into the issue that lit completely ignores the lit.local.cfg files that I've created. The fstream tests are executed even if I build with -DLIBCXX_ENABLE_GLOBAL_FILESYSTEM_NAMESPACE=OFF. Conversely, the fopen.fail.cpp test is still executed even if the global filesystem namespace is available.

It looks like I'm the first person attempting to add a lit.local.cfg to libc++. Maybe we still need to flip a switch to have it enabled? I looked around, but I wasn't able to figure out what to do.

Ed

[jroelofs]

The missing piece is:

Index: test/libcxx/test/format.py
===================================================================
--- test/libcxx/test/format.py	(revision 231941)
+++ test/libcxx/test/format.py	(working copy)
@@ -60,6 +60,9 @@
         is_pass_test = name.endswith('.pass.cpp')
         is_fail_test = name.endswith('.fail.cpp')
 
+        if test.config.unsupported:
+            return lit.Test.UNSUPPORTED, "A lit.local.cfg marked this unsupported"
+
         res = lit.TestRunner.parseIntegratedTestScript(
             test, require_script=is_sh_test)
         # Check if a result for the test was returned. If so return that

With that, LGTM.

[ed]

In D8194#139766, @jroelofs wrote:

The missing piece is:

Index: test/libcxx/test/format.py
===================================================================
--- test/libcxx/test/format.py	(revision 231941)
+++ test/libcxx/test/format.py	(working copy)
@@ -60,6 +60,9 @@
         is_pass_test = name.endswith('.pass.cpp')
         is_fail_test = name.endswith('.fail.cpp')
 
+        if test.config.unsupported:
+            return lit.Test.UNSUPPORTED, "A lit.local.cfg marked this unsupported"
+
         res = lit.TestRunner.parseIntegratedTestScript(
             test, require_script=is_sh_test)
         # Check if a result for the test was returned. If so return that

With that, LGTM.

Awesome! That seems to make things work indeed. Thanks for your time (and patience)!

[EricWF]

I don't like this patch. You define _LIBCPP_HAS_NO_GLOBAL_FILESYSTEM_NAMESPACE in three different places. If it is defined it the __config file there should be no need to define it in the CMakeLists.txt. This seems like a recipe for causing trouble.

Also these are some big changes we are introducing for CloudABI. Could you explain to me where this platform is used and who needs the changes?

libcxx/trunk/include/__config

731 ↗

(On Diff #21836)

Where do we get the definition for __CloudABI__ from?

libcxx/trunk/test/libcxx/test/format.py

63 ↗

(On Diff #21836)

I don't think we should be using this. Why not put the metadata into the tests?

libcxx/trunk/test/std/input.output/file.streams/c.files/no.global.filesystem.namespace/fopen.fail.cpp

8 ↗

(On Diff #21836)

Add // UNSUPPORTED: libcpp-has-no-global-filesystem-namespace

libcxx/trunk/test/std/input.output/file.streams/c.files/no.global.filesystem.namespace/lit.local.cfg

1 ↗

(On Diff #21836)

Remove this file. Add // UNSUPPORTED: libcpp-has-no-global-filesystem-namespace to the tests.

libcxx/trunk/test/std/input.output/file.streams/c.files/no.global.filesystem.namespace/rename.fail.cpp

9 ↗

(On Diff #21836)

Add // UNSUPPORTED: libcpp-has-no-global-filesystem-namespace

libcxx/trunk/test/std/input.output/file.streams/fstreams/lit.local.cfg

1 ↗

(On Diff #21836)

Remove this file. Add // UNSUPPORTED: libcpp-has-no-global-filesystem-namespace to the tests.

libcxx/trunk/test/std/localization/locales/locale.convenience/conversions/conversions.buffer/lit.local.cfg

1 ↗

(On Diff #21836)

Remove this file. Add // UNSUPPORTED: libcpp-has-no-global-filesystem-namespace to the tests.

[jroelofs]

libcxx/trunk/include/__config

731 ↗

(On Diff #21836)

Compiler provides it, just like __APPLE__ and all the others.

libcxx/trunk/test/libcxx/test/format.py

63 ↗

(On Diff #21836)

This is how the tests in llvm/test/CodeGen work. I think it cleans things up significantly. I view it as a mistake that I did the libcpp-has-no-threads UNSUPPORTEDs this way.... it's a bit painful to maintain them.

libcxx/trunk/test/std/input.output/file.streams/c.files/no.global.filesystem.namespace/fopen.fail.cpp

8 ↗

(On Diff #21836)

No, unless you meant // REQUIRES: libcpp-has-no-global-filesystem-namespace.

libcxx/trunk/test/std/input.output/file.streams/c.files/no.global.filesystem.namespace/rename.fail.cpp

9 ↗

(On Diff #21836)

No, unless you meant // REQUIRES: libcpp-has-no-global-filesystem-namespace.

[EricWF]

libcxx/trunk/include/__config

731 ↗

(On Diff #21836)

Where can I find more information about when Clang defines this macro?

libcxx/trunk/test/libcxx/test/format.py

63 ↗

(On Diff #21836)

My concern is that we accidentally don't run tests because they were mistakenly put in a directory with a lit.site.cfg that marks all the tests as unsupported.

I also think that lit.TestRunner.parseIntegratedTestScript may already handle this but I'll have to double check.

libcxx/trunk/test/std/input.output/file.streams/c.files/no.global.filesystem.namespace/fopen.fail.cpp

8 ↗

(On Diff #21836)

Yep. My mistake.

libcxx/trunk/test/std/input.output/file.streams/c.files/no.global.filesystem.namespace/rename.fail.cpp

9 ↗

(On Diff #21836)

I did. Thank you for the correction.

[jroelofs]

libcxx/trunk/test/libcxx/test/format.py

63 ↗

(On Diff #21836)

My concern is that we accidentally don't run tests because they were mistakenly put in a directory with a lit.site.cfg that marks all the tests as unsupported.

--show-unsupported takes care of that, no?

I also think that lit.TestRunner.parseIntegratedTestScript may already handle this but I'll have to double check.

Apparently not, or there's some flag that I missed that makes it happen... I debugged it a bit this morning before suggesting these lines to @ed

[jroelofs]

libcxx/trunk/include/__config

731 ↗

(On Diff #21836)

http://lists.cs.uiuc.edu/pipermail/llvm-commits/Week-of-Mon-20150302/264362.html

http://lists.cs.uiuc.edu/pipermail/cfe-commits/Week-of-Mon-20150309/125077.html

[EricWF]

libcxx/trunk/include/__config

731 ↗

(On Diff #21836)

Thanks. Since _LIBCPP_HAS_NO_GLOBAL_FILESYSTEM_NAMESPACE is set in the __config file I don't really see why we need to manually define it in CMake and LIT unless we want to be able to test these configurations on platforms which are not __CloudABI__ (ex FreeBSD which was mentioned).

Can someone explain why we need this?

libcxx/trunk/test/libcxx/test/format.py

63 ↗

(On Diff #21836)

--show-unsupported should *help* but you still need to be watching it carefully and understand what tests are actually unsupported.

At least with requiring the metadata in the test I can check the commit that put that line in there. If a test is added to a directory that has a lit.site.cfg it's a little harder to figure out.

I don't really mind the extra maintenance cost because it make things more explicit and clear to readers of the test.

Anyway I don't strongly object to this change so I'll drop the subject.

[jroelofs]

libcxx/trunk/include/__config

731 ↗

(On Diff #21836)

Can someone explain why we need this?

Same reason we need the corresponding thing for the singlethreaded stuff...

http://reviews.llvm.org/D8293

[EricWF]

libcxx/trunk/include/__config

731 ↗

(On Diff #21836)

We need the single threaded stuff because that macro is not defined it the __config header but this one is.

[jroelofs]

libcxx/trunk/test/libcxx/test/format.py

63 ↗

(On Diff #21836)

What if they got marked in the lit.local.cfg as xfail instead of unsupported? I could see that being quite a bit less risky as the tests would still get run regardless of the feature.

CMakeLists.txt

 # Define options.
 option(LIBCXX_ENABLE_EXCEPTIONS "Use exceptions." ON)
 option(LIBCXX_ENABLE_RTTI "Use run time type information." ON)
 option(LIBCXX_ENABLE_ASSERTIONS "Enable assertions independent of build mode." ON)
 option(LIBCXX_ENABLE_PEDANTIC "Compile with pedantic enabled." ON)
 option(LIBCXX_ENABLE_WERROR "Fail and stop if a warning is triggered." OFF)
 option(LIBCXX_ENABLE_CXX1Y "Enable -std=c++1y and use of c++1y language features if the compiler supports it." OFF)
 option(LIBCXX_ENABLE_SHARED "Build libc++ as a shared library." ON)
+option(LIBCXX_ENABLE_GLOBAL_FILESYSTEM_NAMESPACE "Build libc++ with support for the global filesystem namespace." ON)
 option(LIBCXX_ENABLE_THREADS "Build libc++ with support for threads." ON)
 option(LIBCXX_BUILD_32_BITS "Build 32 bit libc++" OFF)
 option(LIBCXX_ENABLE_MONOTONIC_CLOCK
   "Build libc++ with support for a monotonic clock.
    This option may only be used when LIBCXX_ENABLE_THREADS=OFF." ON)
 option(LIBCXX_INSTALL_HEADERS "Install the libc++ headers." ON)
 option(LIBCXX_INSTALL_SUPPORT_HEADERS "Install libc++ support headers." ON)
 option(LIBCXX_ENABLE_STATIC_ABI_LIBRARY "Statically link the ABI library" OFF)

 elseif(LIBCXX_BUILD_32_BITS)
   message(FATAL_ERROR "LIBCXX_BUILD_32_BITS=ON is not supported on this platform.")
 endif()
 # This is the _ONLY_ place where add_definitions is called.
 if (MSVC)
   add_definitions(-D_CRT_SECURE_NO_WARNINGS)
 endif()
 
+# LIBCXX_ENABLE_GLOBAL_FILESYSTEM_NAMESPACE configuration
+if (NOT LIBCXX_ENABLE_GLOBAL_FILESYSTEM_NAMESPACE)
+  add_definitions(-D_LIBCPP_HAS_NO_GLOBAL_FILESYSTEM_NAMESPACE)
+endif()
+
 # LIBCXX_ENABLE_THREADS configuration
 if (NOT LIBCXX_ENABLE_THREADS)
   add_definitions(-D_LIBCPP_HAS_NO_THREADS)
   if (NOT LIBCXX_ENABLE_MONOTONIC_CLOCK)
     add_definitions(-D_LIBCPP_HAS_NO_MONOTONIC_CLOCK)
   endif()
 # Ensure LIBCXX_ENABLE_MONOTONIC_CLOCK is set to ON.
 elseif(NOT LIBCXX_ENABLE_MONOTONIC_CLOCK)

include/__config

 #  define _LIBCPP_WEAK __attribute__((__weak__))
 #endif
 
 #if defined(_LIBCPP_HAS_NO_MONOTONIC_CLOCK) && !defined(_LIBCPP_HAS_NO_THREADS)
 #  error _LIBCPP_HAS_NO_MONOTONIC_CLOCK may only be defined when \
          _LIBCPP_HAS_NO_THREADS is defined.
 #endif
 
+// Systems that use capability-based security (FreeBSD with Capsicum,
+// Nuxi CloudABI) may only provide local filesystem access (using *at()).
+// Functions like open(), rename(), unlink() and stat() should not be
+// used, as they attempt to access the global filesystem namespace.
+#ifdef __CloudABI__
+#define _LIBCPP_HAS_NO_GLOBAL_FILESYSTEM_NAMESPACE
+#endif
+
 #endif  // _LIBCPP_CONFIG

include/cstdio

 #endif  // ferror
 
 _LIBCPP_BEGIN_NAMESPACE_STD
 
 using ::FILE;
 using ::fpos_t;
 using ::size_t;
 
+#ifndef _LIBCPP_HAS_NO_GLOBAL_FILESYSTEM_NAMESPACE
 using ::remove;
 using ::rename;
 using ::tmpfile;
 using ::tmpnam;
+#endif
 using ::fclose;
 using ::fflush;
+#ifndef _LIBCPP_HAS_NO_GLOBAL_FILESYSTEM_NAMESPACE
 using ::fopen;
 using ::freopen;
+#endif
 using ::setbuf;
 using ::setvbuf;
 using ::fprintf;
 using ::fscanf;
 using ::printf;
 using ::scanf;
 using ::snprintf;
 using ::sprintf;

include/fstream

#endif
     // 27.9.1.3 Assign/swap:
 #ifndef _LIBCPP_HAS_NO_RVALUE_REFERENCES
     basic_filebuf& operator=(basic_filebuf&& __rhs);
 #endif
     void swap(basic_filebuf& __rhs);
 
     // 27.9.1.4 Members:
     bool is_open() const;
+#ifndef _LIBCPP_HAS_NO_GLOBAL_FILESYSTEM_NAMESPACE
     basic_filebuf* open(const char* __s, ios_base::openmode __mode);
     basic_filebuf* open(const string& __s, ios_base::openmode __mode);
+#endif
     basic_filebuf* close();
 
 protected:
     // 27.9.1.5 Overridden virtual functions:
     virtual int_type underflow();
     virtual int_type pbackfail(int_type __c = traits_type::eof());
     virtual int_type overflow (int_type __c = traits_type::eof());
     virtual basic_streambuf<char_type, traits_type>* setbuf(char_type* __s, streamsize __n);

 template <class _CharT, class _Traits>
 inline _LIBCPP_INLINE_VISIBILITY
 bool
 basic_filebuf<_CharT, _Traits>::is_open() const
 {
     return __file_ != 0;
 }
 
+#ifndef _LIBCPP_HAS_NO_GLOBAL_FILESYSTEM_NAMESPACE
 template <class _CharT, class _Traits>
 basic_filebuf<_CharT, _Traits>*
 basic_filebuf<_CharT, _Traits>::open(const char* __s, ios_base::openmode __mode)
 {
     basic_filebuf<_CharT, _Traits>* __rt = 0;
     if (__file_ == 0)
     {
         __rt = this;

 
 template <class _CharT, class _Traits>
 inline _LIBCPP_INLINE_VISIBILITY
 basic_filebuf<_CharT, _Traits>*
 basic_filebuf<_CharT, _Traits>::open(const string& __s, ios_base::openmode __mode)
 {
     return open(__s.c_str(), __mode);
 }
+#endif
 
 template <class _CharT, class _Traits>
 basic_filebuf<_CharT, _Traits>*
 basic_filebuf<_CharT, _Traits>::close()
 {
     basic_filebuf<_CharT, _Traits>* __rt = 0;
     if (__file_)
     {

 public:
     typedef _CharT                         char_type;
     typedef _Traits                        traits_type;
     typedef typename traits_type::int_type int_type;
     typedef typename traits_type::pos_type pos_type;
     typedef typename traits_type::off_type off_type;
 
     basic_ifstream();
+#ifndef _LIBCPP_HAS_NO_GLOBAL_FILESYSTEM_NAMESPACE
     explicit basic_ifstream(const char* __s, ios_base::openmode __mode = ios_base::in);
     explicit basic_ifstream(const string& __s, ios_base::openmode __mode = ios_base::in);
+#endif
 #ifndef _LIBCPP_HAS_NO_RVALUE_REFERENCES
     basic_ifstream(basic_ifstream&& __rhs);
 #endif
 
 #ifndef _LIBCPP_HAS_NO_RVALUE_REFERENCES
     basic_ifstream& operator=(basic_ifstream&& __rhs);
 #endif
     void swap(basic_ifstream& __rhs);
 
     basic_filebuf<char_type, traits_type>* rdbuf() const;
     bool is_open() const;
+#ifndef _LIBCPP_HAS_NO_GLOBAL_FILESYSTEM_NAMESPACE
     void open(const char* __s, ios_base::openmode __mode = ios_base::in);
     void open(const string& __s, ios_base::openmode __mode = ios_base::in);
+#endif
     void close();
 
 private:
     basic_filebuf<char_type, traits_type> __sb_;
 };
 
 template <class _CharT, class _Traits>
 inline _LIBCPP_INLINE_VISIBILITY
 basic_ifstream<_CharT, _Traits>::basic_ifstream()
     : basic_istream<char_type, traits_type>(&__sb_)
 {
 }
 
+#ifndef _LIBCPP_HAS_NO_GLOBAL_FILESYSTEM_NAMESPACE
 template <class _CharT, class _Traits>
 inline _LIBCPP_INLINE_VISIBILITY
 basic_ifstream<_CharT, _Traits>::basic_ifstream(const char* __s, ios_base::openmode __mode)
     : basic_istream<char_type, traits_type>(&__sb_)
 {
     if (__sb_.open(__s, __mode | ios_base::in) == 0)
         this->setstate(ios_base::failbit);
 }
 
 template <class _CharT, class _Traits>
 inline _LIBCPP_INLINE_VISIBILITY
 basic_ifstream<_CharT, _Traits>::basic_ifstream(const string& __s, ios_base::openmode __mode)
     : basic_istream<char_type, traits_type>(&__sb_)
 {
     if (__sb_.open(__s, __mode | ios_base::in) == 0)
         this->setstate(ios_base::failbit);
 }
+#endif
 
 #ifndef _LIBCPP_HAS_NO_RVALUE_REFERENCES
 
 template <class _CharT, class _Traits>
 inline _LIBCPP_INLINE_VISIBILITY
 basic_ifstream<_CharT, _Traits>::basic_ifstream(basic_ifstream&& __rhs)
     : basic_istream<char_type, traits_type>(_VSTD::move(__rhs)),
       __sb_(_VSTD::move(__rhs.__sb_))

 template <class _CharT, class _Traits>
 inline _LIBCPP_INLINE_VISIBILITY
 bool
 basic_ifstream<_CharT, _Traits>::is_open() const
 {
     return __sb_.is_open();
 }
 
+#ifndef _LIBCPP_HAS_NO_GLOBAL_FILESYSTEM_NAMESPACE
 template <class _CharT, class _Traits>
 void
 basic_ifstream<_CharT, _Traits>::open(const char* __s, ios_base::openmode __mode)
 {
     if (__sb_.open(__s, __mode | ios_base::in))
         this->clear();
     else
         this->setstate(ios_base::failbit);
 }
 
 template <class _CharT, class _Traits>
 void
 basic_ifstream<_CharT, _Traits>::open(const string& __s, ios_base::openmode __mode)
 {
     if (__sb_.open(__s, __mode | ios_base::in))
         this->clear();
     else
         this->setstate(ios_base::failbit);
 }
+#endif
 
 template <class _CharT, class _Traits>
 inline _LIBCPP_INLINE_VISIBILITY
 void
 basic_ifstream<_CharT, _Traits>::close()
 {
     if (__sb_.close() == 0)
         this->setstate(ios_base::failbit);

 
 #ifndef _LIBCPP_HAS_NO_RVALUE_REFERENCES
     basic_ofstream& operator=(basic_ofstream&& __rhs);
 #endif
     void swap(basic_ofstream& __rhs);
 
     basic_filebuf<char_type, traits_type>* rdbuf() const;
     bool is_open() const;
+#ifndef _LIBCPP_HAS_NO_GLOBAL_FILESYSTEM_NAMESPACE
     void open(const char* __s, ios_base::openmode __mode = ios_base::out);
     void open(const string& __s, ios_base::openmode __mode = ios_base::out);
+#endif
     void close();
 
 private:
     basic_filebuf<char_type, traits_type> __sb_;
 };
 
 template <class _CharT, class _Traits>
 inline _LIBCPP_INLINE_VISIBILITY
 basic_ofstream<_CharT, _Traits>::basic_ofstream()
     : basic_ostream<char_type, traits_type>(&__sb_)
 {
 }
 
+#ifndef _LIBCPP_HAS_NO_GLOBAL_FILESYSTEM_NAMESPACE
 template <class _CharT, class _Traits>
 inline _LIBCPP_INLINE_VISIBILITY
 basic_ofstream<_CharT, _Traits>::basic_ofstream(const char* __s, ios_base::openmode __mode)
     : basic_ostream<char_type, traits_type>(&__sb_)
 {
     if (__sb_.open(__s, __mode | ios_base::out) == 0)
         this->setstate(ios_base::failbit);
 }
 
 template <class _CharT, class _Traits>
 inline _LIBCPP_INLINE_VISIBILITY
 basic_ofstream<_CharT, _Traits>::basic_ofstream(const string& __s, ios_base::openmode __mode)
     : basic_ostream<char_type, traits_type>(&__sb_)
 {
     if (__sb_.open(__s, __mode | ios_base::out) == 0)
         this->setstate(ios_base::failbit);
 }
+#endif
 
 #ifndef _LIBCPP_HAS_NO_RVALUE_REFERENCES
 
 template <class _CharT, class _Traits>
 inline _LIBCPP_INLINE_VISIBILITY
 basic_ofstream<_CharT, _Traits>::basic_ofstream(basic_ofstream&& __rhs)
     : basic_ostream<char_type, traits_type>(_VSTD::move(__rhs)),
       __sb_(_VSTD::move(__rhs.__sb_))

 template <class _CharT, class _Traits>
 inline _LIBCPP_INLINE_VISIBILITY
 bool
 basic_ofstream<_CharT, _Traits>::is_open() const
 {
     return __sb_.is_open();
 }
 
+#ifndef _LIBCPP_HAS_NO_GLOBAL_FILESYSTEM_NAMESPACE
 template <class _CharT, class _Traits>
 void
 basic_ofstream<_CharT, _Traits>::open(const char* __s, ios_base::openmode __mode)
 {
     if (__sb_.open(__s, __mode | ios_base::out))
         this->clear();
     else
         this->setstate(ios_base::failbit);
 }
 
 template <class _CharT, class _Traits>
 void
 basic_ofstream<_CharT, _Traits>::open(const string& __s, ios_base::openmode __mode)
 {
     if (__sb_.open(__s, __mode | ios_base::out))
         this->clear();
     else
         this->setstate(ios_base::failbit);
 }
+#endif
 
 template <class _CharT, class _Traits>
 inline _LIBCPP_INLINE_VISIBILITY
 void
 basic_ofstream<_CharT, _Traits>::close()
 {
     if (__sb_.close() == 0)
         this->setstate(ios_base::failbit);
 }
 
 // basic_fstream
 
 template <class _CharT, class _Traits>
 class _LIBCPP_TYPE_VIS_ONLY basic_fstream
     : public basic_iostream<_CharT, _Traits>
 {
 public:
     typedef _CharT                         char_type;
     typedef _Traits                        traits_type;
     typedef typename traits_type::int_type int_type;
     typedef typename traits_type::pos_type pos_type;
     typedef typename traits_type::off_type off_type;
 
     basic_fstream();
+#ifndef _LIBCPP_HAS_NO_GLOBAL_FILESYSTEM_NAMESPACE
     explicit basic_fstream(const char* __s, ios_base::openmode __mode = ios_base::in | ios_base::out);
     explicit basic_fstream(const string& __s, ios_base::openmode __mode = ios_base::in | ios_base::out);
+#endif
 #ifndef _LIBCPP_HAS_NO_RVALUE_REFERENCES
     basic_fstream(basic_fstream&& __rhs);
 #endif
 
 #ifndef _LIBCPP_HAS_NO_RVALUE_REFERENCES
     basic_fstream& operator=(basic_fstream&& __rhs);
 #endif
     void swap(basic_fstream& __rhs);
 
     basic_filebuf<char_type, traits_type>* rdbuf() const;
     bool is_open() const;
+#ifndef _LIBCPP_HAS_NO_GLOBAL_FILESYSTEM_NAMESPACE
     void open(const char* __s, ios_base::openmode __mode = ios_base::in | ios_base::out);
     void open(const string& __s, ios_base::openmode __mode = ios_base::in | ios_base::out);
+#endif
     void close();
 
 private:
     basic_filebuf<char_type, traits_type> __sb_;
 };
 
 template <class _CharT, class _Traits>
 inline _LIBCPP_INLINE_VISIBILITY
 basic_fstream<_CharT, _Traits>::basic_fstream()
     : basic_iostream<char_type, traits_type>(&__sb_)
 {
 }
 
+#ifndef _LIBCPP_HAS_NO_GLOBAL_FILESYSTEM_NAMESPACE
 template <class _CharT, class _Traits>
 inline _LIBCPP_INLINE_VISIBILITY
 basic_fstream<_CharT, _Traits>::basic_fstream(const char* __s, ios_base::openmode __mode)
     : basic_iostream<char_type, traits_type>(&__sb_)
 {
     if (__sb_.open(__s, __mode) == 0)
         this->setstate(ios_base::failbit);
 }
 
 template <class _CharT, class _Traits>
 inline _LIBCPP_INLINE_VISIBILITY
 basic_fstream<_CharT, _Traits>::basic_fstream(const string& __s, ios_base::openmode __mode)
     : basic_iostream<char_type, traits_type>(&__sb_)
 {
     if (__sb_.open(__s, __mode) == 0)
         this->setstate(ios_base::failbit);
 }
+#endif
 
 #ifndef _LIBCPP_HAS_NO_RVALUE_REFERENCES
 
 template <class _CharT, class _Traits>
 inline _LIBCPP_INLINE_VISIBILITY
 basic_fstream<_CharT, _Traits>::basic_fstream(basic_fstream&& __rhs)
     : basic_iostream<char_type, traits_type>(_VSTD::move(__rhs)),
       __sb_(_VSTD::move(__rhs.__sb_))

 template <class _CharT, class _Traits>
 inline _LIBCPP_INLINE_VISIBILITY
 bool
 basic_fstream<_CharT, _Traits>::is_open() const
 {
     return __sb_.is_open();
 }
 
+#ifndef _LIBCPP_HAS_NO_GLOBAL_FILESYSTEM_NAMESPACE
 template <class _CharT, class _Traits>
 void
 basic_fstream<_CharT, _Traits>::open(const char* __s, ios_base::openmode __mode)
 {
     if (__sb_.open(__s, __mode))
         this->clear();
     else
         this->setstate(ios_base::failbit);
 }
 
 template <class _CharT, class _Traits>
 void
 basic_fstream<_CharT, _Traits>::open(const string& __s, ios_base::openmode __mode)
 {
     if (__sb_.open(__s, __mode))
         this->clear();
     else
         this->setstate(ios_base::failbit);
 }
+#endif
 
 template <class _CharT, class _Traits>
 inline _LIBCPP_INLINE_VISIBILITY
 void
 basic_fstream<_CharT, _Traits>::close()
 {
     if (__sb_.close() == 0)
         this->setstate(ios_base::failbit);
 }
 
 _LIBCPP_END_NAMESPACE_STD
 
 #endif  // _LIBCPP_FSTREAM

test/CMakeLists.txt

if (LIT_EXECUTABLE)
 
   set(LIBCXX_LIT_VARIANT "libcxx" CACHE STRING
       "Configuration variant to use for LIT.")
 
   pythonize_bool(LIBCXX_ENABLE_EXCEPTIONS)
   pythonize_bool(LIBCXX_ENABLE_RTTI)
   pythonize_bool(LIBCXX_ENABLE_SHARED)
   pythonize_bool(LIBCXX_BUILD_32_BITS)
+  pythonize_bool(LIBCXX_ENABLE_GLOBAL_FILESYSTEM_NAMESPACE)
   pythonize_bool(LIBCXX_ENABLE_THREADS)
   pythonize_bool(LIBCXX_ENABLE_MONOTONIC_CLOCK)
   # The tests shouldn't link to any ABI library when it has been linked into
   # libc++ statically.
   if (LIBCXX_ENABLE_STATIC_ABI_LIBRARY)
     set(LIBCXX_CXX_ABI_LIBNAME "none")
   endif()
   set(LIBCXX_TARGET_INFO "libcxx.test.target_info.LocalTI" CACHE STRING

test/libcxx/test/config.py

def configure_default_compile_flags(self):
         self.configure_compile_flags_header_includes()
         if self.target_info.platform() == 'linux':
             self.cxx.compile_flags += ['-D__STDC_FORMAT_MACROS',
                                        '-D__STDC_LIMIT_MACROS',
                                        '-D__STDC_CONSTANT_MACROS']
         # Configure feature flags.
         self.configure_compile_flags_exceptions()
         self.configure_compile_flags_rtti()
+        self.configure_compile_flags_no_global_filesystem_namespace()
         enable_32bit = self.get_lit_bool('enable_32bit', False)
         if enable_32bit:
             self.cxx.flags += ['-m32']
         # Configure threading features.
         enable_threads = self.get_lit_bool('enable_threads', True)
         enable_monotonic_clock = self.get_lit_bool('enable_monotonic_clock',
                                                    True)
         if not enable_threads:
def configure_compile_flags_exceptions(self):
             self.cxx.compile_flags += ['-fno-exceptions']
 
     def configure_compile_flags_rtti(self):
         enable_rtti = self.get_lit_bool('enable_rtti', True)
         if not enable_rtti:
             self.config.available_features.add('libcpp-no-rtti')
             self.cxx.compile_flags += ['-fno-rtti', '-D_LIBCPP_NO_RTTI']
 
+    def configure_compile_flags_no_global_filesystem_namespace(self):
+        enable_global_filesystem_namespace = self.get_lit_bool(
+            'enable_global_filesystem_namespace', True)
+        if not enable_global_filesystem_namespace:
+            self.config.available_features.add(
+                'libcpp-has-no-global-filesystem-namespace')
+            self.cxx.compile_flags += [
+                '-D_LIBCPP_HAS_NO_GLOBAL_FILESYSTEM_NAMESPACE']
+
     def configure_compile_flags_no_threads(self):
         self.cxx.compile_flags += ['-D_LIBCPP_HAS_NO_THREADS']
         self.config.available_features.add('libcpp-has-no-threads')
 
     def configure_compile_flags_no_monotonic_clock(self):
         self.cxx.compile_flags += ['-D_LIBCPP_HAS_NO_MONOTONIC_CLOCK']
         self.config.available_features.add('libcpp-has-no-monotonic-clock')
 

test/lit.site.cfg.in

 @AUTO_GEN_COMMENT@
 config.cxx_under_test           = "@LIBCXX_COMPILER@"
 config.std                      = "@LIBCXX_STD_VERSION@"
 config.libcxx_src_root          = "@LIBCXX_SOURCE_DIR@"
 config.libcxx_obj_root          = "@LIBCXX_BINARY_DIR@"
 config.cxx_library_root         = "@LIBCXX_LIBRARY_DIR@"
 config.enable_exceptions        = "@LIBCXX_ENABLE_EXCEPTIONS@"
 config.enable_rtti              = "@LIBCXX_ENABLE_RTTI@"
 config.enable_shared            = "@LIBCXX_ENABLE_SHARED@"
 config.enable_32bit             = "@LIBCXX_BUILD_32_BITS@"
+config.enable_global_filesystem_namespace = "@LIBCXX_ENABLE_GLOBAL_FILESYSTEM_NAMESPACE@"
 config.enable_threads           = "@LIBCXX_ENABLE_THREADS@"
 config.enable_monotonic_clock   = "@LIBCXX_ENABLE_MONOTONIC_CLOCK@"
 config.cxx_abi                  = "@LIBCXX_CXX_ABI_LIBNAME@"
 config.use_sanitizer            = "@LLVM_USE_SANITIZER@"
 config.abi_library_path         = "@LIBCXX_CXX_ABI_LIBRARY_PATH@"
 config.configuration_variant    = "@LIBCXX_LIT_VARIANT@"
 config.target_triple            = "@LIBCXX_TARGET_TRIPLE@"
 config.sysroot                  = "@LIBCXX_SYSROOT@"
 config.gcc_toolchain            = "@LIBCXX_GCC_TOOLCHAIN@"
 config.target_info              = "@LIBCXX_TARGET_INFO@"
 config.executor                 = "@LIBCXX_EXECUTOR@"
 
 # Let the main config do the real work.
 lit_config.load_config(config, "@LIBCXX_SOURCE_DIR@/test/lit.cfg")

test/std/input.output/file.streams/c.files/cstdio.pass.cpp

 
 int main()
 {
     std::FILE* fp = 0;
     std::fpos_t fpos = {0};
     std::size_t s = 0;
     char* cp = 0;
     std::va_list va;
+#ifndef _LIBCPP_HAS_NO_GLOBAL_FILESYSTEM_NAMESPACE
     static_assert((std::is_same<decltype(std::remove("")), int>::value), "");
     static_assert((std::is_same<decltype(std::rename("","")), int>::value), "");
     static_assert((std::is_same<decltype(std::tmpfile()), std::FILE*>::value), "");
     static_assert((std::is_same<decltype(std::tmpnam(cp)), char*>::value), "");
+#endif
     static_assert((std::is_same<decltype(std::fclose(fp)), int>::value), "");
     static_assert((std::is_same<decltype(std::fflush(fp)), int>::value), "");
+#ifndef _LIBCPP_HAS_NO_GLOBAL_FILESYSTEM_NAMESPACE
     static_assert((std::is_same<decltype(std::fopen("", "")), std::FILE*>::value), "");
     static_assert((std::is_same<decltype(std::freopen("", "", fp)), std::FILE*>::value), "");
+#endif
     static_assert((std::is_same<decltype(std::setbuf(fp,cp)), void>::value), "");
     static_assert((std::is_same<decltype(std::vfprintf(fp,"",va)), int>::value), "");
     static_assert((std::is_same<decltype(std::fprintf(fp," ")), int>::value), "");
     static_assert((std::is_same<decltype(std::fscanf(fp,"")), int>::value), "");
     static_assert((std::is_same<decltype(std::printf(" ")), int>::value), "");
     static_assert((std::is_same<decltype(std::scanf(" ")), int>::value), "");
     static_assert((std::is_same<decltype(std::snprintf(cp,0," ")), int>::value), "");
     static_assert((std::is_same<decltype(std::sprintf(cp," ")), int>::value), "");

test/std/input.output/file.streams/c.files/no.global.filesystem.namespace/fopen.fail.cpp

+//===----------------------------------------------------------------------===//
+//
+//                     The LLVM Compiler Infrastructure
+//
+// This file is dual licensed under the MIT and the University of Illinois Open
+// Source Licenses. See LICENSE.TXT for details.
+//
+//===----------------------------------------------------------------------===//
+
+#include <cstdio>
+
+int main() {
+    // fopen is not available on systems without a global filesystem namespace.
+    std::fopen("", "");
+}

test/std/input.output/file.streams/c.files/no.global.filesystem.namespace/lit.local.cfg

+if 'libcpp-has-no-global-filesystem-namespace' not in config.available_features:
+    config.unsupported = True

test/std/input.output/file.streams/fstreams/lit.local.cfg

+if 'libcpp-has-no-global-filesystem-namespace' in config.available_features:
+    config.unsupported = True

test/std/localization/locales/locale.convenience/conversions/conversions.buffer/lit.local.cfg

+if 'libcpp-has-no-global-filesystem-namespace' in config.available_features:
+    config.unsupported = True

test/support/platform_support.h

 // Define a bunch of macros that can be used in the tests instead of
 //  implementation defined assumptions:
 //   - locale names
 //   - floating point number string output
 
 #ifndef PLATFORM_SUPPORT_H
 #define PLATFORM_SUPPORT_H
 
+#include <__config>
+
 // locale names
 #ifdef _WIN32
 // WARNING: Windows does not support UTF-8 codepages.
 // Locales are "converted" using http://docs.moodle.org/dev/Table_of_locales
 #define LOCALE_en_US_UTF_8     "English_United States.1252"
 #define LOCALE_cs_CZ_ISO8859_2 "Czech_Czech Republic.1250"
 #define LOCALE_fr_FR_UTF_8     "French_France.1252"
 #define LOCALE_fr_CA_ISO8859_1 "French_Canada.1252"

 
 #if defined(_NEWLIB_VERSION) && defined(__STRICT_ANSI__)
 // Newlib provies this, but in the header it's under __STRICT_ANSI__
 extern "C" {
   int mkstemp(char*);
 }
 #endif
 
+#ifndef _LIBCPP_HAS_NO_GLOBAL_FILESYSTEM_NAMESPACE
 inline
 std::string
 get_temp_file_name()
 {
 #if defined(_LIBCPP_MSVCRT) || defined(__MINGW32__)
     char Path[MAX_PATH+1];
     char FN[MAX_PATH+1];
     do { } while (0 == GetTempPath(MAX_PATH+1, Path));
do {
             perror("mkstemp");
             abort();
         }
     } while (FD == -1);
     close(FD);
     return Name;
 #endif
 }
+#endif // _LIBCPP_HAS_NO_GLOBAL_FILESYSTEM_NAMESPACE
 
 #endif // PLATFORM_SUPPORT_H