iOS restore ordering for an open Application Support SQLite file

I am trying to understand one supported iOS lifecycle guarantee. Consider a generic app that stores a single SQLite database in its private Library/Application Support directory and keeps one SQLite connection open while its process is alive.

During a supported platform operation such as iCloud restore that continues after setup, Finder or Apple Devices restore, Quick Start direct transfer, Quick Start using iCloud, reinstall or offload recovery, or an app update, can the app become or remain running, background executing, or suspended while iOS restores, replaces, or rebinds its data container or a file within it?

More specifically, can an existing open file descriptor or SQLite connection continue to reference an old filesystem object while a later lookup of the same Application Support path resolves to a restored or replacement object?

If iOS does not permit that condition, what supported lifecycle invariant prevents it? For example, does iOS terminate the app before restored data becomes visible, gate launch until the complete per-app restored container is finalized, or keep the container binding stable for the lifetime of the process?

If the behavior differs by mechanism, please distinguish iCloud restore after setup, Finder or Apple Devices restore, Quick Start direct transfer, Quick Start using iCloud, reinstall or offload recovery, and app update.

• Does the platform's restore ordering depend on SQLite locks?

• Does NSFileCoordinator participate when platform services restore private Application Support files?

• Is there Apple documentation or an Apple-staff explanation that defines this ordering, including supported versions, conditions, or exceptions?

The POSIX issue is that an open descriptor may continue to reference an old object after pathname replacement while a new lookup reaches a different object. SQLite also documents risks when an open database file is renamed or unlinked.

I am not treating a raw rename or unlink test as equivalent to an Apple restore. I am explicitly excluding arbitrary unlink, rename, overwrite, or other direct same-container filesystem attacks. My question is only whether Apple's supported restore and container services can create an equivalent old-open-object versus newly-resolved-path condition while the same app process survives.

keeps one SQLite connection open while its process is alive.

Don't do that.

More specifically, can an existing open file descriptor or SQLite connection continue to reference an old filesystem object while a later lookup of the same Application Support path resolves to a restored or replacement object?

You're well into "undefined" territory there. I'm certain that no such guarantees exist, and if they did, they should be dismissed out of hand.

lifecycle invariant prevents it?

Apple never documents system behaviour at that level, and if they did, you can guarantee it would be wrong.

Does NSFileCoordinator participate when platform services restore private Application Support files?

Obviously you couldn't use NSFileCoordinator on a file that you never close. That should be a big hint.

SQLite also documents risks when an open database file is renamed or unlinked.

risks

I am not treating a raw rename or unlink test as equivalent to an Apple restore. I am explicitly excluding arbitrary unlink, rename, overwrite, or other direct same-container filesystem attacks. My question is only whether Apple's supported restore and container services can create an equivalent old-open-object versus newly-resolved-path condition while the same app process survives.

Seems like you're going about this the wrong way. You should focus on arbitrary unlink, rename, and overwrites. Detect those conditions and gracefully recover. You can get started on this today and test it.

Apple isn't going to tell you anything about how the system works. If they did, it would likely be obsolete in a matter of weeks.

In general, the system will not update your app’s container while the app is running (and that includes being suspended in the background). If the system needs to do something to your container — for example, recovering space by nixing the caches directory — it’ll terminate your app first.

There are exceptions to this general rule. The one that springs to mind is the Documents directory. If the app chooses to make this visible to the user, it need to use file coordination to avoid the sorts of problems you’re talking about.

There’s also the iOS Apps on Mac feature, which lets your app run on a much less constrained platform.

Finally, for SQLite specifically, you have to worry about 0xdead10cc “dead lock” terminations.

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

iOS restore ordering for an open Application Support SQLite file
 
 
Q