with restrictive permissions, then the attacker could not create a symbolic link in the
target directory. If the race condition is omitted - e.g. by using lower-level coding
constructs that ensure the open() will only succeed if the file did not exist beforehand -
then the open would fail if an attack is launched.