Unfortunately this is still not enough. The problem is that many (if not
most) shells do not implement noclobber in a race-free way, but even if
they do, noclobber still allows writing to device special files, so a
symlink to /dev/hda will be followed by the shell destroying your master
boot record. As far as I know, there is no portable way to safely create
lock files in a world-writable directory from a bourne-shell script.
If the script runs as root (as it is the case with request-route), it is
enough to put the lockfile in a directory writable only by root. Debian
uses /var/run for the request-route lockfile.
Zoltan