summaryrefslogtreecommitdiff
path: root/bin/rm/rm.c
Commit message (Collapse)AuthorAgeFilesLines
* fts_read: Handle error from a NULL return better.Bryan Drewery2020-12-081-1/+1
| | | | | | | | | | | | | | | | | | | | This is addressing cases such as fts_read(3) encountering an [EIO] from fchdir(2) when FTS_NOCHDIR is not set. That would otherwise be seen as a successful traversal in some of these cases while silently discarding expected work. As noted in r264201, fts_read() does not set errno to 0 on a successful EOF so it needs to be set before calling it. Otherwise we might see a random error from one of the iterations. gzip is ignoring most errors and could be improved separately. Reviewed by: vangyzen Sponsored by: Dell EMC Differential Revision: https://reviews.freebsd.org/D27184 Notes: svn path=/head/; revision=368467
* Remove include of stdint.h. It was added in r241014 for uintmax_t,Xin LI2020-04-231-1/+0
| | | | | | | | | which is gone in r340330 and is therefore no longer necessary. MFC after: 2 weeks Notes: svn path=/head/; revision=360213
* rm(1): Formalize non-functional status of -P flagConrad Meyer2018-11-101-97/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | -P was introduced in 4.4BSD-Lite2 around 1994. It overwrote file contents with a pass of 0xff, 0x00, then 0xff, in a low effort attempt to "really delete" files. It has no user-visible effect; at the end of the day, the file is unlinked via the filesystem. Furthermore, the utility of overwriting files with patterned data is extremely limited due to caveats at every layer of the stack[0] and therefore mostly futile. At the least, three passes is likely wasteful on modern hardware[1]. It could also be seen as a violation of the "Unix Philosophy" to do one thing per tiny, composable program. Since 1994, FreeBSD has left it alone; OpenBSD replaced it with a single pass of arc4random(3) output in 2012[2]; and NetBSD implemented partial, but explicitly incomplete support for U.S. DoD 5220.22-M, "National Industrial Security Program Operating Manual" in 2004[3]. NetBSD's enhanced comment above rm_overwrite makes a strong case for removing the flag entirely: > This is an expensive way to keep people from recovering files from your > non-snapshotted FFS filesystems using fsdb(8). Really. No more. > > It is impossible to actually conform to the exact procedure given in > [NISPOM] if one is overwriting a file, not an entire disk, because the > procedure requires examination and comparison of the disk's defect lists. > Any program that claims to securely erase *files* while conforming to the > standard, then, is not correct. > > Furthermore, the presence of track caches, disk and controller write > caches, and so forth make it extremely difficult to ensure that data have > actually been written to the disk, particularly when one tries to repeatedly > overwrite the same sectors in quick succession. We call fsync(), but > controllers with nonvolatile cache, as well as IDE disks that just plain lie > about the stable storage of data, will defeat this. > > [NISPOM] requires physical media destruction, rather than any technique of > the sort attempted here, for secret data. As a first step towards evental removal, make it a placebo. It's not like it was serving any security function. It is not defined in or mentioned by POSIX. If you are security conscious and need to erase your files, use a woodchipper. At a minimum, the entire disk needs to be overwritten, not just one file. [0]: https://www.ru.nl/publish/pages/909282/draft-paper.pdf [1]: https://commons.erau.edu/cgi/viewcontent.cgi?article=1131&context=jdfsl [2]: https://github.com/openbsd/src/commit/7c5c57ba81b5fe8ff2d4899ff643af18c [3]: https://github.com/NetBSD/src/commit/fdf0a7a25e59af958fca1e2159921562cd Reviewed by: markj, Daniel O'Connor <darius AT dons.net.au> (previous version) Differential Revision: https://reviews.freebsd.org/D17906 Notes: svn path=/head/; revision=340330
* Fix unlink(1) for files starting with -Ed Maste2018-09-121-7/+6
| | | | | | | | | | | | | | | | | | Restore the original behavior of unlink(1), passing the provided filename directly to unlink(2), handling the first argument being "--" correctly. This fixes "unlink -foo", broken in r97533. PR: 228448 Submitted by: Brennan Vincent <brennan@umanwizard.com> (original version) Submitted by: Yuri Pankov Reported by: Brennan Vincent <brennan@umanwizard.com> Reviewed by: emaste, kevans, vangyzen, 0mp Approved by: re (delphij) Differential Revision: https://reviews.freebsd.org/D17132 Notes: svn path=/head/; revision=338620
* General further adoption of SPDX licensing ID tags.Pedro F. Giffuni2017-11-201-0/+2
| | | | | | | | | | | | | | | | | Mainly focus on files that use BSD 3-Clause license. The Software Package Data Exchange (SPDX) group provides a specification to make it easier for automated tools to detect and summarize well known opensource licenses. We are gradually adopting the specification, noting that the tags are considered only advisory and do not, in any way, superceed or replace the license texts. Special thanks to Wind River for providing access to "The Duke of Highlander" tool: an older (2014) run over FreeBSD tree was useful as a starting point. Notes: svn path=/head/; revision=326025
* Fix cosmetic nit when printing out "override $mode" and "$owner/$group ..."Enji Cooper2017-11-051-1/+1
| | | | | | | | | | | | The wrong index was being checked for == ' ' in the resulting stringified mode from strmode(3) -- it should have been the 11th value, not the 10th. MFC after: 3 days PR: 76711 Submitted by: Vasil Dimov <vd@datamax.bg> Notes: svn path=/head/; revision=325450
* Renumber copyright clause 4Warner Losh2017-02-281-1/+1
| | | | | | | | | | | | Renumber cluase 4 to 3, per what everybody else did when BSD granted them permission to remove clause 3. My insistance on keeping the same numbering for legal reasons is too pedantic, so give up on that point. Submitted by: Jan Schaumann <jschauma@stevens.edu> Pull Request: https://github.com/freebsd/freebsd/pull/96 Notes: svn path=/head/; revision=314436
* Protecting against rm -rf / is now POSIXLY_CORRECT per posix 1003.1Baptiste Daroussin2015-11-071-2/+1
| | | | | | | | | | | | edition 2013. No need anymore to disable the protection if one set the POXILY_CORRECT environment variable. Reviewed by: imp MFC after: 3 days Differential Revision: https://reviews.freebsd.org/D4092 Notes: svn path=/head/; revision=290480
* Respect locale settings.Xin LI2015-08-281-0/+3
| | | | | | | MFC after: 2 weeks Notes: svn path=/head/; revision=287237
* rm -rf can fail sometimes with an error from fts_read. Make it honorWarner Losh2014-07-071-1/+1
| | | | | | | | | | | | | | | | fflag to ignore fts_read errors, but stop deleting from that directory because no further progress can be made. When building a kernel with a high -j value on a high core count machine, during the cleanobj phase we can wind up doing multiple rm -rf at the same time for modules that have subdirectories. This exposed this race (sometimes) as fts_read can return an error if the directory is removed by another rm -rf. Since the intent of the -f flag was to ignore errors, even if this was a bug in fts_read, we should ignore the error like we've been instructed to do. Notes: svn path=/head/; revision=268376
* Add two more 'static' qualifiersEitan Adler2013-04-261-2/+2
| | | | Notes: svn path=/head/; revision=249950
* Take some improvements from DragonFlyBSD:Eitan Adler2013-04-261-17/+17
| | | | | | | | | | | | | - add const where appropriate - add static where appropriate - fix a whitespace issues Reviewed by: brooks Obtained from: DragonFlyBSD MFC After: 1 week Notes: svn path=/head/; revision=249949
* Add -x option to avoid crossing mount points when removing a hierarchy.Eitan Adler2013-04-261-4/+9
| | | | | | | | | Discussed on: -hackers Inspired by: DragonflyBSD MFC After: 1 week Notes: svn path=/head/; revision=249948
* Fix bin/ build with a 64-bit ino_t.Matthew D Fleming2012-09-271-2/+3
| | | | | | | Original code by: Gleb Kurtsou Notes: svn path=/head/; revision=241014
* Polish previous revision: if the fts_* routines have lstat()'ed theXin LI2012-06-201-2/+8
| | | | | | | | | | | | directory entry then use the struct stat from that instead of doing it again, and skip the rm_overwrite() call if fts_read() indicated that the entry couldn't be a regular file. Obtained from: OpenBSD MFC after: 1 week Notes: svn path=/head/; revision=237339
* Fix potential symlink race condition in "rm -P" by adding a checkKevin Lo2012-06-201-2/+9
| | | | | | | | | | that the file we have opened is the one we expected. Also open in non-blocking mode to avoid a potential hang with FIFOs. Obtained from: NetBSD via OpenBSD Notes: svn path=/head/; revision=237284
* Put some static keywords in the source code.Ed Schouten2011-10-311-4/+4
| | | | | | | | | For these simple utilities, it doesn't harm to make all global variables static. In fact, this allows the compiler to perform better forms of optimisation and analysis. Notes: svn path=/head/; revision=226961
* bin: Prefer strrchr() to rindex().Jilles Tjoelker2011-03-151-1/+1
| | | | | | | This removes the last index/rindex usage from /bin. Notes: svn path=/head/; revision=219680
* rm(1): clarify that -P works only when blocks are updated in-placeUlrich Spörlein2010-10-081-2/+2
| | | | | | | Suggested by: pjd, ivoras, arundel Notes: svn path=/head/; revision=213582
* rm, find -delete: fix removing symlinks with uchg/uappnd set.Jilles Tjoelker2009-05-301-3/+3
| | | | | | | | | | | | | | | Formerly, this tried to clear the flags on the symlink's target instead of the symlink itself. As before, this only happens for root or for the unlink(1) variant of rm. PR: bin/111226 (part of) Submitted by: Martin Kammerhofer Approved by: ed (mentor) MFC after: 3 weeks Notes: svn path=/head/; revision=193087
* Implement ^T support for rm: now it will report the next file itWarner Losh2009-04-291-0/+29
| | | | | | | | | removes when you hit ^T. This is similar to what's done for cp. The signal handler and type definitions for "info" were borrowed directly from cp. Notes: svn path=/head/; revision=191670
* Correct a security issue introduced in previous commit:Xin LI2006-10-311-2/+2
| | | | | | | | | | | | | | | | | | | | | | | instead of removing the file and issue a warning about the removal, do not do any operation at all in case -P is specified when the dinode has hard links. With -f and -P specified together, we assume that the user wants rm to overwrite the contents of the file and remove it (destroy the contents of file but leave its hard links as is). The reason of doing it this way is that, in case where a hard link is created by a malicious user (currently this is permitted even if the user has no access to the file). Losing the link can potentially mean that the actual owner would lose control completely to the user who wants to obtain access in a future day. Discussed with: Peter Jermey Notes: svn path=/head/; revision=163812
* Be more reasonable when overwrite mode is specified while thereXin LI2006-10-301-0/+5
| | | | | | | | | | | | is hard links. Overwritting when links > 1 would cause data loss, which is usually undesired. Inspired by: discussion on -hackers@ Suggested by: elessar at bsdforen de Obtained from: OpenBSD Notes: svn path=/head/; revision=163777
* o Backout rev. 1.55. Don't waste cpu cycles for bzero(), do notMaxim Konovalov2006-10-181-2/+1
| | | | | | | | | call chflags() for whiteouted files. Prodded by: ru Notes: svn path=/head/; revision=163485
* o Zero out struct stat before usage. lstat(2) can fail andMaxim Konovalov2006-10-181-0/+1
| | | | | | | | | | | leave garbage there which will break -W code path. PR: bin/84569 Submitted by: Igor MFC after: 2 weeks Notes: svn path=/head/; revision=163476
* o Be pedantic and do fts_close() when done.Maxim Konovalov2006-04-151-0/+1
| | | | | | | | | PR: bin/95292 Submitted by: Charles Hardin Obtained from: NetBSD via OpenBSD, PR Notes: svn path=/head/; revision=157770
* Handle the case where the -P flag is specified for a read-only fileDoug Barton2005-09-291-4/+5
| | | | | | | | | | | | | | | | | earlier, and more gracefully. Previously, this combination would be ignored early in the code where permissions are tested and fail later with a very unhelpful "permission denied" error. Instead, test for this flag in the same block that generates the "override?" messages for read-only files, but instead of trying to guess what the user has in mind, generate an error and exit. Update the man page to reflect this new behavior. Not objected to by: freebsd-hackers@ Notes: svn path=/head/; revision=150729
* UNIX conformance: If -r -f on non-existent directory, don't emit error.Jordan K. Hubbard2004-11-131-1/+4
| | | | Notes: svn path=/head/; revision=137639
* Add -I, an option that asks for confirmation once if recursivelyXin LI2004-10-281-3/+62
| | | | | | | | | | | | | | | | | | | | | | | | removing directories or if more than 3 files are listed in the command line. This feature is intended to provide a safe net but not being too annoying like having "rm -i" for every deleting operations, and is generally good for both newbies and power users, preventing them from being so easily run into ``rm -rf /'', ``rm -rf *'' and so forth. Originally implemented by Matthew Dillon for DragonFly, plus some improvements done by various DragonFly contributors. Approved by: murray (mentor; the original dillon's version) Discussed with: des Obtained from: DragonFly's bin/rm/ rm.c rev. 1.4 - 1.8 rm.1 rev. 1.3 - 1.4 MFC After: 1 month Notes: svn path=/head/; revision=137009
* The previous commit added code to rm(1) to warn about and remove anyDag-Erling Smørgrav2004-10-041-1/+2
| | | | | | | | | | | | | | | | | | occurrences of "/" in the argument list. This corresponds to Enhancement Request Number 5 in the Austin Group TC2 Aardvark's XCU Defects Report (<URL:http://www.opengroup.org/austin/aardvark/finaltext/xcubug.txt>). Further discussion is available in the Austin Group mailing list archives (<URL:http://www.opengroup.org/austin/mailarchives/>, "Defect in XCU rm") and for Austin Group members, in the Austin Group Interpretations archive (<URL:http://www.opengroup.org/austin/interps/>, AI-019) This commit makes that check conditional on !POSIXLY_CORRECT, since it is not strictly correct according to the current version of the standard (but is expected to be correct according to the next version, and has already been adopted by Solaris). Notes: svn path=/head/; revision=136124
* Find out how flame-proof my underwear really is.Dag-Erling Smørgrav2004-10-041-0/+23
| | | | Notes: svn path=/head/; revision=136113
* Whitespace cleanup.Dag-Erling Smørgrav2004-10-041-4/+4
| | | | Notes: svn path=/head/; revision=136112
* Remove clause 3 from the UCB licenses.Mark Murray2004-04-061-4/+0
| | | | | | | OK'ed by: imp, core Notes: svn path=/head/; revision=127958
* o Fix a style bug and poor wording in comment.Jun Kuriyama2004-01-011-2/+10
| | | | | | | | | | | | o When fts_read() cannot stat the file, it can't be unlinked. At that case, don't display error message when -f flag is used. Obtained from: bde PR: kern/16815, bin/35842 Reported by: kuriyama, Aleksandr A. Babaylov <.@babolo.ru> Notes: svn path=/head/; revision=124041
* When the P flag is set (i.e. Overwrite regular files before deleting them),Guido van Rooij2003-11-101-8/+14
| | | | | | | | | | | | do only unlink the file if we could indeed overwrite the file. Old behaviour: rm -P /tmp/foo (foo mode 0444) would NOT overwrite foo, but still delete it (with a warning: rm: foo: Permission denied) New behaviour: Just the EPERM warning, but no deletion Reviewed by: bde Notes: svn path=/head/; revision=122409
* 1. Fixed leakage of a file descriptor for every non-fatal failure inBruce Evans2003-11-081-1/+3
| | | | | | | | | | | | | | | | | | rm_overwrite() (for rm -P). 2. Print the file name in the error message for (fatal) malloc() failures in rm_overwrite(). I first thought that malloc() failures should be non-fatal since they don't prevent proceeding the the next file, but making them non-fatal would normally give too much output for rm -Pr on a large tree in the unlikely event that even one occurs, since the malloc()ed amounts are usually the same. Just print the file name since the malloc()ed amounts are not always the same and it doesn't hurt to know where rm was when it quit. Submitted by: guido ((1) and original version of (2)) Notes: svn path=/head/; revision=122304
* Quiet warnings about copyright[].David E. O'Brien2003-05-011-2/+2
| | | | Notes: svn path=/head/; revision=114433
* s/filesystem/file system/ as discussed on -developersTom Rhodes2002-08-211-2/+2
| | | | Notes: svn path=/head/; revision=102230
* Complain if more than one file argument is given to unlink(1) like we didTim J. Robbins2002-07-121-1/+1
| | | | | | | before I made unlink use getopt(). Notes: svn path=/head/; revision=99858
* err() is documented as allowing NULL for the format string but GCC isn'tMatthew Dillon2002-07-101-2/+2
| | | | | | | happy about it any more so change the usage to make buildworld work again. Notes: svn path=/head/; revision=99744
* Consistently use FBSDIDDavid E. O'Brien2002-06-301-3/+2
| | | | Notes: svn path=/head/; revision=99110
* Reject options, handle "--" correctly in unlink(1).Tim J. Robbins2002-05-301-4/+7
| | | | Notes: svn path=/head/; revision=97533
* Consistancy check s/file system/filesystem/Tom Rhodes2002-05-161-2/+2
| | | | | | | Reviewed by: brian Notes: svn path=/head/; revision=96702
* Move user_from_uid to pwd.hWarner Losh2002-02-141-0/+2
| | | | | | | | | | | | | | | | Move group_from_gid to grp.h Remove from stdlib.h Make the prototypes match the code Fix rm and mv to include new files. NetBSD has these defined in those files, and others too that I've not done. Approved by: terminal room kabal Reviewed by: jhb, phk Notes: svn path=/head/; revision=90644
* o __P has been reovedWarner Losh2002-02-021-23/+13
| | | | | | | | | | | | o Old-style K&R declarations have been converted to new C89 style o register has been removed o prototype for main() has been removed (gcc3 makes it an error) o int main(int argc, char *argv[]) is the preferred main definition. o Attempt to not break style(9) conformance for declarations more than they already are. Notes: svn path=/head/; revision=90110
* Add prototypes for main() so that these programs compile with -WerrorLuigi Rizzo2001-12-141-0/+1
| | | | | | | | | | | | | | | (which somehow now seems to be the default for compiling -current). This error popped up while doing a PicoBSD cross-compile on a 4.3-ish system, it may well be that there are other apps which have similar problems, but I did not spot them as they are not included in my picobsd config. Whether adding prototypes for main() is the correct solution or not I have no idea, a request to -current on the matter went basically unanswered. Those who have better ideas are welcome to back this out and replace it with the correct fix. Notes: svn path=/head/; revision=87893
* Removed wrong cast for fts_open()'s third argument.Ruslan Ermilov2001-06-131-1/+1
| | | | Notes: svn path=/head/; revision=78170
* Display pathname of item being rm'ed.David E. O'Brien2000-12-201-3/+3
| | | | | | | Submitted by: Peter Pentchev <roam@orbitel.bg> Notes: svn path=/head/; revision=70219
* Switch over to using the new fflagstostr and strtofflags library calls.Josef Karthauser2000-06-171-8/+6
| | | | Notes: svn path=/head/; revision=61749
* Remove unused #include.Jeroen Ruigrok van der Werven2000-05-011-1/+0
| | | | Notes: svn path=/head/; revision=59863
generated by cgit v1.2.3 (git 2.25.1) at 2025-08-07 13:29:06 +0000