Add an map_copy_read_only API

[rocallahan]

It's useful to be able to map a file PROT_READ and MAP_PRIVATE on Linux. Later on you can make some pages writeable and write them, or use /proc/.../mem to write them. Currently memmap can do this but it takes two steps: a map_copy followed by make_read_only, during which there's a short window when the pages are writeable.

[fogti]

PROT_READ + MAP_PRIVATE is also useful if one then casts the slice into utf8 because this allows an safer usage of mmap (verified const utf8 content (&[u8]) will stay the same, without violation of Rusts strict aliasing rules).

[fogti]

example usage: https://github.com/zserik/readfilez/blob/master/src/lib.rs

[adamreichold]

@zseri I am somewhat late to comment on this, but I think

PROT_READ + MAP_PRIVATE is also useful if one then casts the slice into utf8 because this allows an safer usage of mmap (verified const utf8 content (&[u8]) will stay the same, without violation of Rusts strict aliasing rules).

is not correct as the Linux manual page for mmap says

It is unspecified whether changes made to the file after the mmap() call are visible in the mapped region.

concerning MAP_PRIVATE, i.e. it ensures that your changes do not propagate to the underlying file, but it does not seem to ensure that changes to the underlying file do not propagate into your mapping, i.e. another process could possibly turn the file contents into invalid UTF-8 after you validated it.

As a result of the discussion at https://users.rust-lang.org/t/how-unsafe-is-mmap/19635, I think we need another mapping mode that is sort of the converse of MAP_PRIVATE, maybe MAP_SNAPSHOT, which ensures that if a process has read a page at least once, it will not change even if the underlying file changes. Or alternatively, the unspecified part of the behaviour of MAP_PRIVATE would need to be strengthened into that direction.

[fogti]

Yeah, I also noticed that... A far bigger problem is also that the underlying file can suddenly become truncated, and if the mapping is then read, it might fail with SIGBUS.