1 /* remove.c -- core functions for removing files and directories
2 Copyright (C) 88, 90, 91, 1994-2006 Free Software Foundation, Inc.
4 This program is free software; you can redistribute it and/or modify
5 it under the terms of the GNU General Public License as published by
6 the Free Software Foundation; either version 2, or (at your option)
9 This program is distributed in the hope that it will be useful,
10 but WITHOUT ANY WARRANTY; without even the implied warranty of
11 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 GNU General Public License for more details.
14 You should have received a copy of the GNU General Public License
15 along with this program; if not, write to the Free Software Foundation,
16 Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. */
18 /* Extracted from rm.c and librarified, then rewritten by Jim Meyering. */
22 #include <sys/types.h>
27 #include "cycle-check.h"
30 #include "euidaccess.h"
31 #include "euidaccess-stat.h"
32 #include "file-type.h"
40 #include "root-dev-ino.h"
41 #include "unlinkdir.h"
44 /* Avoid shadowing warnings because these are functions declared
45 in dirname.h as well as locals used below. */
46 #define dir_name rm_dir_name
47 #define dir_len rm_dir_len
49 #define obstack_chunk_alloc malloc
50 #define obstack_chunk_free free
52 /* This is the maximum number of consecutive readdir/unlink calls that
53 can be made (with no intervening rewinddir or closedir/opendir) before
54 triggering a bug that makes readdir return NULL even though some
55 directory entries have not been processed. The bug afflicts SunOS's
56 readdir when applied to ufs file systems and Darwin 6.5's (and OSX
57 v.10.3.8's) HFS+. This maximum is conservative in that demonstrating
58 the problem requires a directory containing at least 16 deletable
59 entries (which doesn't count . and ..).
60 This problem also affects Darwin 7.9.0 (aka MacOS X 10.3.9) on HFS+
61 and NFS-mounted file systems, but not vfat ones. */
64 CONSECUTIVE_READDIR_UNLINK_THRESHOLD = 10
67 /* FIXME: in 2009, or whenever Darwin 7.9.0 (aka MacOS X 10.3.9) is no
68 longer relevant, remove this work-around code. Then, there will be
69 no need to perform the extra rewinddir call, ever. */
70 #define NEED_REWIND(readdir_unlink_count) \
71 (CONSECUTIVE_READDIR_UNLINK_THRESHOLD <= (readdir_unlink_count))
79 typedef enum Ternary Ternary;
81 /* The prompt function may be called twice for a given directory.
82 The first time, we ask whether to descend into it, and the
83 second time, we ask whether to remove it. */
86 PA_DESCEND_INTO_DIR = 2,
90 /* Initial capacity of per-directory hash table of entries that have
91 been processed but not been deleted. */
92 enum { HT_UNREMOVABLE_INITIAL_CAPACITY = 13 };
94 /* An entry in the active directory stack.
95 Each entry corresponds to an `active' directory. */
98 /* For a given active directory, this is the set of names of
99 entries in that directory that could/should not be removed.
100 For example, `.' and `..', as well as files/dirs for which
101 unlink/rmdir failed e.g., due to access restrictions. */
102 Hash_table *unremovable;
104 /* Record the status for a given active directory; we need to know
105 whether an entry was not removed, either because of an error or
106 because the user declined. */
107 enum RM_status status;
109 /* The directory's dev/ino. Used to ensure that a malicious user does
110 not replace a directory we're about to process with a symlink to
111 some other directory. */
112 struct dev_ino dev_ino;
115 extern char *program_name;
117 struct dirstack_state
119 /* The name of the directory (starting with and relative to a command
120 line argument) being processed. When a subdirectory is entered, a new
121 component is appended (pushed). Remove (pop) the top component
122 upon chdir'ing out of a directory. This is used to form the full
123 name of the current directory or a file therein, when necessary. */
124 struct obstack dir_stack;
126 /* Stack of lengths of directory names (including trailing slash)
127 appended to dir_stack. We have to have a separate stack of lengths
128 (rather than just popping back to previous slash) because the first
129 element pushed onto the dir stack may contain slashes. */
130 struct obstack len_stack;
132 /* Stack of active directory entries.
133 The first `active' directory is the initial working directory.
134 Additional active dirs are pushed onto the stack as we `chdir'
135 into each directory to be processed. When finished with the
136 hierarchy under a directory, pop the active dir stack. */
137 struct obstack Active_dir;
139 /* Used to detect cycles. */
140 struct cycle_check_state cycle_check_state;
142 /* Target of a longjmp in case rm has to stop processing the current
143 command-line argument. This happens 1) when rm detects a directory
144 cycle or 2) when it has processed one or more directories, but then
145 is unable to return to the initial working directory to process
146 additional `.'-relative command-line arguments. */
147 jmp_buf current_arg_jumpbuf;
149 typedef struct dirstack_state Dirstack_state;
151 /* Just like close(fd), but don't modify errno. */
153 close_preserve_errno (int fd)
155 int saved_errno = errno;
156 int result = close (fd);
161 /* Like fstatat, but cache the result. If ST->st_size is -1, the
162 status has not been gotten yet. If less than -1, fstatat failed
163 with errno == -1 - ST->st_size. Otherwise, the status has already
164 been gotten, so return 0. */
166 cache_fstatat (int fd, char const *file, struct stat *st, int flag)
168 if (st->st_size == -1 && fstatat (fd, file, st, flag) != 0)
169 st->st_size = -1 - errno;
170 if (0 <= st->st_size)
172 errno = -1 - st->st_size;
176 /* Initialize a fstatat cache *ST. */
178 cache_stat_init (struct stat *st)
183 /* Return true if *ST has been statted. */
185 cache_statted (struct stat *st)
187 return (st->st_size != -1);
190 /* Return true if *ST has been statted successfully. */
192 cache_stat_ok (struct stat *st)
194 return (0 <= st->st_size);
205 hash_compare_strings (void const *x, void const *y)
207 return STREQ (x, y) ? true : false;
211 push_dir (Dirstack_state *ds, const char *dir_name)
213 size_t len = strlen (dir_name);
215 /* Append the string onto the stack. */
216 obstack_grow (&ds->dir_stack, dir_name, len);
218 /* Append a trailing slash. */
219 obstack_1grow (&ds->dir_stack, '/');
221 /* Add one for the slash. */
224 /* Push the length (including slash) onto its stack. */
225 obstack_grow (&ds->len_stack, &len, sizeof (len));
228 /* Return the entry name of the directory on the top of the stack
229 in malloc'd storage. */
231 top_dir (Dirstack_state const *ds)
233 size_t n_lengths = obstack_object_size (&ds->len_stack) / sizeof (size_t);
234 size_t *length = obstack_base (&ds->len_stack);
235 size_t top_len = length[n_lengths - 1];
236 char const *p = obstack_next_free (&ds->dir_stack) - top_len;
237 char *q = xmalloc (top_len);
238 memcpy (q, p, top_len - 1);
244 pop_dir (Dirstack_state *ds)
246 size_t n_lengths = obstack_object_size (&ds->len_stack) / sizeof (size_t);
247 size_t *length = obstack_base (&ds->len_stack);
249 assert (n_lengths > 0);
250 size_t top_len = length[n_lengths - 1];
251 assert (top_len >= 2);
253 /* Pop the specified length of file name. */
254 assert (obstack_object_size (&ds->dir_stack) >= top_len);
255 obstack_blank (&ds->dir_stack, -top_len);
257 /* Pop the length stack, too. */
258 assert (obstack_object_size (&ds->len_stack) >= sizeof (size_t));
259 obstack_blank (&ds->len_stack, -(int) sizeof (size_t));
262 /* Copy the SRC_LEN bytes of data beginning at SRC into the DST_LEN-byte
263 buffer, DST, so that the last source byte is at the end of the destination
264 buffer. If SRC_LEN is longer than DST_LEN, then set *TRUNCATED.
265 Set *RESULT to point to the beginning of (the portion of) the source data
266 in DST. Return the number of bytes remaining in the destination buffer. */
269 right_justify (char *dst, size_t dst_len, const char *src, size_t src_len,
270 char **result, bool *truncated)
275 if (src_len <= dst_len)
278 dp = dst + (dst_len - src_len);
283 sp = src + (src_len - dst_len);
289 *result = memcpy (dp, sp, src_len);
290 return dst_len - src_len;
293 /* Using the global directory name obstack, create the full name FILENAME.
294 Return it in sometimes-realloc'd space that should not be freed by the
295 caller. Realloc as necessary. If realloc fails, use a static buffer
296 and put as long a suffix in that buffer as possible. */
298 #define full_filename(Filename) full_filename_ (ds, Filename)
300 full_filename_ (Dirstack_state const *ds, const char *filename)
302 static char *buf = NULL;
303 static size_t n_allocated = 0;
305 size_t dir_len = obstack_object_size (&ds->dir_stack);
306 char *dir_name = obstack_base (&ds->dir_stack);
307 size_t n_bytes_needed;
310 filename_len = strlen (filename);
311 n_bytes_needed = dir_len + filename_len + 1;
313 if (n_allocated < n_bytes_needed)
315 /* This code requires that realloc accept NULL as the first arg.
316 This function must not use xrealloc. Otherwise, an out-of-memory
317 error involving a file name to be expanded here wouldn't ever
318 be issued. Use realloc and fall back on using a static buffer
319 if memory allocation fails. */
320 char *new_buf = realloc (buf, n_bytes_needed);
321 n_allocated = n_bytes_needed;
325 #define SBUF_SIZE 512
326 #define ELLIPSES_PREFIX "[...]"
327 static char static_buf[SBUF_SIZE];
333 len = right_justify (static_buf, SBUF_SIZE, filename,
334 filename_len + 1, &p, &truncated);
335 right_justify (static_buf, len, dir_name, dir_len, &p, &truncated);
338 memcpy (static_buf, ELLIPSES_PREFIX,
339 sizeof (ELLIPSES_PREFIX) - 1);
347 if (filename_len == 1 && *filename == '.' && dir_len)
349 /* FILENAME is just `.' and dir_len is nonzero.
350 Copy the directory part, omitting the trailing slash,
351 and append a trailing zero byte. */
352 char *p = mempcpy (buf, dir_name, dir_len - 1);
357 /* Copy the directory part, including trailing slash, and then
358 append the filename part, including a trailing zero byte. */
359 memcpy (mempcpy (buf, dir_name, dir_len), filename, filename_len + 1);
360 assert (strlen (buf) + 1 == n_bytes_needed);
367 AD_stack_height (Dirstack_state const *ds)
369 return obstack_object_size (&ds->Active_dir) / sizeof (struct AD_ent);
372 static inline struct AD_ent *
373 AD_stack_top (Dirstack_state const *ds)
375 return (struct AD_ent *)
376 ((char *) obstack_next_free (&ds->Active_dir) - sizeof (struct AD_ent));
380 AD_stack_pop (Dirstack_state *ds)
382 assert (0 < AD_stack_height (ds));
384 /* operate on Active_dir. pop and free top entry */
385 struct AD_ent *top = AD_stack_top (ds);
386 if (top->unremovable)
387 hash_free (top->unremovable);
388 obstack_blank (&ds->Active_dir, -(int) sizeof (struct AD_ent));
392 AD_stack_clear (Dirstack_state *ds)
394 while (0 < AD_stack_height (ds))
400 static Dirstack_state *
403 Dirstack_state *ds = xmalloc (sizeof *ds);
404 obstack_init (&ds->dir_stack);
405 obstack_init (&ds->len_stack);
406 obstack_init (&ds->Active_dir);
411 ds_clear (Dirstack_state *ds)
413 obstack_free (&ds->dir_stack, obstack_finish (&ds->dir_stack));
414 obstack_free (&ds->len_stack, obstack_finish (&ds->len_stack));
415 while (0 < AD_stack_height (ds))
417 obstack_free (&ds->Active_dir, obstack_finish (&ds->Active_dir));
421 ds_free (Dirstack_state *ds)
423 obstack_free (&ds->dir_stack, NULL);
424 obstack_free (&ds->len_stack, NULL);
425 obstack_free (&ds->Active_dir, NULL);
429 /* Pop the active directory (AD) stack and move *DIRP `up' one level,
430 safely. Moving `up' usually means opening `..', but when we've just
431 finished recursively processing a command-line directory argument,
432 there's nothing left on the stack, so set *DIRP to NULL in that case.
433 The idea is to return with *DIRP opened on the parent directory,
434 assuming there are entries in that directory that we need to remove.
436 Whenever using chdir '..' (virtually, now, via openat), verify
437 that the post-chdir dev/ino numbers for `.' match the saved ones.
438 If any system call fails or if dev/ino don't match then give a
439 diagnostic and longjump out.
440 Set *PREV_DIR to the name (in malloc'd storage) of the
441 directory (usually now empty) from which we're coming, and which
442 corresponds to the input value of *DIRP. */
444 AD_pop_and_chdir (DIR **dirp, Dirstack_state *ds, char **prev_dir)
446 struct AD_ent *leaf_dir_ent = AD_stack_top(ds);
447 struct dev_ino leaf_dev_ino = leaf_dir_ent->dev_ino;
448 enum RM_status old_status = leaf_dir_ent->status;
451 /* Get the name of the current (but soon to be `previous') directory
452 from the top of the stack. */
453 *prev_dir = top_dir (ds);
457 top = AD_stack_top (ds);
459 /* If the directory we're about to leave (and try to rmdir)
460 is the one whose dev_ino is being used to detect a cycle,
461 reset cycle_check_state.dev_ino to that of the parent.
462 Otherwise, once that directory is removed, its dev_ino
463 could be reused in the creation (by some other process)
464 of a directory that this rm process would encounter,
465 which would result in a false-positive cycle indication. */
466 CYCLE_CHECK_REFLECT_CHDIR_UP (&ds->cycle_check_state,
467 top->dev_ino, leaf_dev_ino);
469 /* Propagate any failure to parent. */
470 UPDATE_STATUS (top->status, old_status);
472 assert (AD_stack_height (ds));
474 if (1 < AD_stack_height (ds))
477 int fd = openat (dirfd (*dirp), "..", O_RDONLY);
478 if (closedir (*dirp) != 0)
480 error (0, errno, _("FATAL: failed to close directory %s"),
481 quote (full_filename (*prev_dir)));
482 goto next_cmdline_arg;
485 /* The above fails with EACCES when *DIRP is readable but not
486 searchable, when using Solaris' openat. Without this openat
487 call, tests/rm2 would fail to remove directories a/2 and a/3. */
489 fd = openat (AT_FDCWD, full_filename ("."), O_RDONLY);
493 error (0, errno, _("FATAL: cannot open .. from %s"),
494 quote (full_filename (*prev_dir)));
495 goto next_cmdline_arg;
501 _("FATAL: cannot ensure %s (returned to via ..) is safe"),
502 quote (full_filename (".")));
506 /* Ensure that post-chdir dev/ino match the stored ones. */
507 if ( ! SAME_INODE (sb, top->dev_ino))
509 error (0, 0, _("FATAL: directory %s changed dev/ino"),
510 quote (full_filename (".")));
514 *dirp = fdopendir (fd);
517 error (0, errno, _("FATAL: cannot return to .. from %s"),
518 quote (full_filename (".")));
525 longjmp (ds->current_arg_jumpbuf, 1);
530 if (closedir (*dirp) != 0)
532 error (0, errno, _("FATAL: failed to close directory %s"),
533 quote (full_filename (*prev_dir)));
534 goto next_cmdline_arg;
540 /* Initialize *HT if it is NULL.
541 Insert FILENAME into HT. */
543 AD_mark_helper (Hash_table **ht, char *filename)
547 *ht = hash_initialize (HT_UNREMOVABLE_INITIAL_CAPACITY, NULL, hash_pjw,
548 hash_compare_strings, hash_freer);
552 void *ent = hash_insert (*ht, filename);
563 /* Mark FILENAME (in current directory) as unremovable. */
565 AD_mark_as_unremovable (Dirstack_state *ds, char const *filename)
567 AD_mark_helper (&AD_stack_top(ds)->unremovable, xstrdup (filename));
570 /* Mark the current directory as unremovable. I.e., mark the entry
571 in the parent directory corresponding to `.'.
572 This happens e.g., when an opendir fails and the only name
573 the caller has conveniently at hand is `.'. */
575 AD_mark_current_as_unremovable (Dirstack_state *ds)
577 struct AD_ent *top = AD_stack_top (ds);
578 char *curr = top_dir (ds);
580 assert (1 < AD_stack_height (ds));
583 AD_mark_helper (&top->unremovable, curr);
586 /* Push an initial dummy entry onto the stack.
587 This will always be the bottommost entry on the stack. */
589 AD_push_initial (Dirstack_state *ds)
593 /* Extend the stack. */
594 obstack_blank (&ds->Active_dir, sizeof (struct AD_ent));
596 /* Fill in the new values. */
597 top = AD_stack_top (ds);
598 top->unremovable = NULL;
600 /* These should never be used.
601 Give them values that might look suspicious
602 in a debugger or in a diagnostic. */
603 top->dev_ino.st_dev = TYPE_MAXIMUM (dev_t);
604 top->dev_ino.st_ino = TYPE_MAXIMUM (ino_t);
607 /* Push info about the current working directory (".") onto the
608 active directory stack. DIR is the ./-relative name through
609 which we've just `chdir'd to this directory. DIR_SB_FROM_PARENT
610 is the result of calling lstat on DIR from the parent of DIR.
611 Longjump out (skipping the entire command line argument we're
612 dealing with) if `fstat (FD_CWD, ...' fails or if someone has
613 replaced DIR with e.g., a symlink to some other directory. */
615 AD_push (int fd_cwd, Dirstack_state *ds, char const *dir,
616 struct stat const *dir_sb_from_parent)
622 /* If our uses of openat are guaranteed not to
623 follow a symlink, then we can skip this check. */
627 if (fstat (fd_cwd, &sb) != 0)
629 error (0, errno, _("FATAL: cannot enter directory %s"),
630 quote (full_filename (".")));
631 longjmp (ds->current_arg_jumpbuf, 1);
634 if ( ! SAME_INODE (sb, *dir_sb_from_parent))
637 _("FATAL: just-changed-to directory %s changed dev/ino"),
638 quote (full_filename (".")));
639 longjmp (ds->current_arg_jumpbuf, 1);
643 if (cycle_check (&ds->cycle_check_state, dir_sb_from_parent))
646 WARNING: Circular directory structure.\n\
647 This almost certainly means that you have a corrupted file system.\n\
648 NOTIFY YOUR SYSTEM MANAGER.\n\
649 The following directory is part of the cycle:\n %s\n"),
650 quote (full_filename (".")));
651 longjmp (ds->current_arg_jumpbuf, 1);
654 /* Extend the stack. */
655 obstack_blank (&ds->Active_dir, sizeof (struct AD_ent));
657 /* The active directory stack must be one larger than the length stack. */
658 assert (AD_stack_height (ds) ==
659 1 + obstack_object_size (&ds->len_stack) / sizeof (size_t));
661 /* Fill in the new values. */
662 top = AD_stack_top (ds);
663 top->dev_ino.st_dev = dir_sb_from_parent->st_dev;
664 top->dev_ino.st_ino = dir_sb_from_parent->st_ino;
665 top->unremovable = NULL;
669 AD_is_removable (Dirstack_state const *ds, char const *file)
671 struct AD_ent *top = AD_stack_top (ds);
672 return ! (top->unremovable && hash_lookup (top->unremovable, file));
675 /* Return true if DIR is determined to be an empty directory. */
677 is_empty_dir (int fd_cwd, char const *dir)
680 struct dirent const *dp;
682 int fd = openat (fd_cwd, dir,
683 (O_RDONLY | O_DIRECTORY
684 | O_NOCTTY | O_NOFOLLOW | O_NONBLOCK));
689 dirp = fdopendir (fd);
697 dp = readdir_ignoring_dot_and_dotdot (dirp);
702 return saved_errno == 0 ? true : false;
705 /* Return true if FILE is determined to be an unwritable non-symlink.
706 Otherwise, return false (including when lstat'ing it fails).
707 Set *BUF to the file status.
708 This is to avoid calling euidaccess when FILE is a symlink. */
710 write_protected_non_symlink (int fd_cwd,
712 Dirstack_state const *ds,
715 if (cache_fstatat (fd_cwd, file, buf, AT_SYMLINK_NOFOLLOW) != 0)
717 if (S_ISLNK (buf->st_mode))
719 /* Here, we know FILE is not a symbolic link. */
721 /* In order to be reentrant -- i.e., to avoid changing the working
722 directory, and at the same time to be able to deal with alternate
723 access control mechanisms (ACLs, xattr-style attributes) and
724 arbitrarily deep trees -- we need a function like eaccessat, i.e.,
725 like Solaris' eaccess, but fd-relative, in the spirit of openat. */
727 /* In the absence of a native eaccessat function, here are some of
728 the implementation choices [#4 and #5 were suggested by Paul Eggert]:
729 1) call openat with O_WRONLY|O_NOCTTY
730 Disadvantage: may create the file and doesn't work for directory,
731 may mistakenly report `unwritable' for EROFS or ACLs even though
732 perm bits say the file is writable.
734 2) fake eaccessat (save_cwd, fchdir, call euidaccess, restore_cwd)
735 Disadvantage: changes working directory (not reentrant) and can't
736 work if save_cwd fails.
738 3) if (euidaccess (full_filename (file), W_OK) == 0)
739 Disadvantage: doesn't work if full_filename is too long.
740 Inefficient for very deep trees (O(Depth^2)).
742 4) If the full pathname is sufficiently short (say, less than
743 PATH_MAX or 8192 bytes, whichever is shorter):
744 use method (3) (i.e., euidaccess (full_filename (file), W_OK));
745 Otherwise: vfork, fchdir in the child, run euidaccess in the
746 child, then the child exits with a status that tells the parent
747 whether euidaccess succeeded.
749 This avoids the O(N**2) algorithm of method (3), and it also avoids
750 the failure-due-to-too-long-file-names of method (3), but it's fast
751 in the normal shallow case. It also avoids the lack-of-reentrancy
752 and the save_cwd problems.
753 Disadvantage; it uses a process slot for very-long file names,
754 and would be very slow for hierarchies with many such files.
756 5) If the full file name is sufficiently short (say, less than
757 PATH_MAX or 8192 bytes, whichever is shorter):
758 use method (3) (i.e., euidaccess (full_filename (file), W_OK));
759 Otherwise: look just at the file bits. Perhaps issue a warning
760 the first time this occurs.
762 This is like (4), except for the "Otherwise" case where it isn't as
763 "perfect" as (4) but is considerably faster. It conforms to current
764 POSIX, and is uniformly better than what Solaris and FreeBSD do (they
765 mess up with long file names). */
768 /* This implements #5: */
770 = obstack_object_size (&ds->dir_stack) + strlen (file);
772 return (file_name_len < MIN (PATH_MAX, 8192)
773 ? euidaccess (full_filename (file), W_OK) != 0 && errno == EACCES
774 : euidaccess_stat (buf, W_OK) != 0);
778 /* Prompt whether to remove FILENAME, if required via a combination of
779 the options specified by X and/or file attributes. If the file may
780 be removed, return RM_OK. If the user declines to remove the file,
781 return RM_USER_DECLINED. If not ignoring missing files and we
782 cannot lstat FILENAME, then return RM_ERROR.
784 Depending on MODE, ask whether to `descend into' or to `remove' the
785 directory FILENAME. MODE is ignored when FILENAME is not a directory.
786 Set *IS_EMPTY to T_YES if FILENAME is an empty directory, and it is
787 appropriate to try to remove it with rmdir (e.g. recursive mode).
788 Don't even try to set *IS_EMPTY when MODE == PA_REMOVE_DIR. */
789 static enum RM_status
790 prompt (int fd_cwd, Dirstack_state const *ds, char const *filename,
792 struct rm_options const *x, enum Prompt_action mode,
795 bool write_protected = false;
797 *is_empty = T_UNKNOWN;
799 if (((!x->ignore_missing_files & (x->interactive | x->stdin_tty))
800 && (write_protected = write_protected_non_symlink (fd_cwd, filename,
804 if (cache_fstatat (fd_cwd, filename, sbuf, AT_SYMLINK_NOFOLLOW) != 0)
806 /* This happens, e.g., with `rm '''. */
807 error (0, errno, _("cannot remove %s"),
808 quote (full_filename (filename)));
812 if (S_ISDIR (sbuf->st_mode) && !x->recursive)
814 error (0, EISDIR, _("cannot remove %s"),
815 quote (full_filename (filename)));
819 /* Using permissions doesn't make sense for symlinks. */
820 if (S_ISLNK (sbuf->st_mode))
822 if ( ! x->interactive)
824 write_protected = false;
827 /* Issue the prompt. */
829 char const *quoted_name = quote (full_filename (filename));
831 /* FIXME: use a variant of error (instead of fprintf) that doesn't
832 append a newline. Then we won't have to declare program_name in
834 if (S_ISDIR (sbuf->st_mode)
836 && mode == PA_DESCEND_INTO_DIR
837 && ((*is_empty = (is_empty_dir (fd_cwd, filename) ? T_YES : T_NO))
841 ? _("%s: descend into write-protected directory %s? ")
842 : _("%s: descend into directory %s? ")),
843 program_name, quoted_name);
846 /* TRANSLATORS: You may find it more convenient to translate
847 the equivalent of _("%s: remove %s (write-protected) %s? ").
848 It should avoid grammatical problems with the output
852 ? _("%s: remove write-protected %s %s? ")
853 : _("%s: remove %s %s? ")),
854 program_name, file_type (sbuf), quoted_name);
858 return RM_USER_DECLINED;
864 /* Return true if FILENAME is a directory (and not a symlink to a directory).
865 Otherwise, including the case in which lstat fails, return false.
866 *ST is FILENAME's tstatus.
867 Do not modify errno. */
869 is_dir_lstat (char const *filename, struct stat *st)
871 int saved_errno = errno;
873 (cache_fstatat (AT_FDCWD, filename, st, AT_SYMLINK_NOFOLLOW) == 0
874 && S_ISDIR (st->st_mode));
879 #if HAVE_STRUCT_DIRENT_D_TYPE
881 /* True if the type of the directory entry D is known. */
882 # define DT_IS_KNOWN(d) ((d)->d_type != DT_UNKNOWN)
884 /* True if the type of the directory entry D must be T. */
885 # define DT_MUST_BE(d, t) ((d)->d_type == (t))
888 # define DT_IS_KNOWN(d) false
889 # define DT_MUST_BE(d, t) false
892 #define DO_UNLINK(Fd_cwd, Filename, X) \
895 if (unlinkat (Fd_cwd, Filename, 0) == 0) \
898 printf (_("removed %s\n"), quote (full_filename (Filename))); \
902 if (errno == ENOENT && (X)->ignore_missing_files) \
907 #define DO_RMDIR(Fd_cwd, Filename, X) \
910 if (unlinkat (Fd_cwd, Filename, AT_REMOVEDIR) == 0) /* rmdir */ \
913 printf (_("removed directory: %s\n"), \
914 quote (full_filename (Filename))); \
918 if (errno == ENOENT && (X)->ignore_missing_files) \
921 if (errno == ENOTEMPTY || errno == EEXIST) \
922 return RM_NONEMPTY_DIR; \
926 /* Remove the file or directory specified by FILENAME.
927 Return RM_OK if it is removed, and RM_ERROR or RM_USER_DECLINED if not.
928 But if FILENAME specifies a non-empty directory, return RM_NONEMPTY_DIR. */
930 static enum RM_status
931 remove_entry (int fd_cwd, Dirstack_state const *ds, char const *filename,
933 struct rm_options const *x, struct dirent const *dp)
935 Ternary is_empty_directory;
936 enum RM_status s = prompt (fd_cwd, ds, filename, st, x, PA_DESCEND_INTO_DIR,
937 &is_empty_directory);
938 bool known_to_be_dir = (cache_stat_ok (st) && S_ISDIR (st->st_mode));
943 /* Why bother with the following if/else block? Because on systems with
944 an unlink function that *can* unlink directories, we must determine the
945 type of each entry before removing it. Otherwise, we'd risk unlinking
946 an entire directory tree simply by unlinking a single directory; then
947 all the storage associated with that hierarchy would not be freed until
948 the next fsck. Not nice. To avoid that, on such slightly losing
949 systems, we need to call lstat to determine the type of each entry,
950 and that represents extra overhead that -- it turns out -- we can
951 avoid on non-losing systems, since there, unlink will never remove
952 a directory. Also, on systems where unlink may unlink directories,
953 we're forced to allow a race condition: we lstat a non-directory, then
954 go to unlink it, but in the mean time, a malicious someone could have
955 replaced it with a directory. */
957 if (cannot_unlink_dir ())
959 if (known_to_be_dir && ! x->recursive)
961 error (0, EISDIR, _("cannot remove %s"),
962 quote (full_filename (filename)));
966 /* is_empty_directory is set iff it's ok to use rmdir.
967 Note that it's set only in interactive mode -- in which case it's
968 an optimization that arranges so that the user is asked just
969 once whether to remove the directory. */
970 if (is_empty_directory == T_YES)
971 DO_RMDIR (fd_cwd, filename, x);
973 /* If we happen to know that FILENAME is a directory, return now
974 and let the caller remove it -- this saves the overhead of a failed
975 unlink call. If FILENAME is a command-line argument, then dp is NULL,
976 so we'll first try to unlink it. Using unlink here is ok, because it
977 cannot remove a directory. */
978 if ((dp && DT_MUST_BE (dp, DT_DIR)) || known_to_be_dir)
979 return RM_NONEMPTY_DIR;
981 DO_UNLINK (fd_cwd, filename, x);
983 /* Upon a failed attempt to unlink a directory, most non-Linux systems
984 set errno to the POSIX-required value EPERM. In that case, change
985 errno to EISDIR so that we emit a better diagnostic. */
986 if (! x->recursive && errno == EPERM && is_dir_lstat (filename, st))
990 || errno == ENOENT || errno == ENOTDIR
991 || errno == ELOOP || errno == ENAMETOOLONG)
993 /* Either --recursive is not in effect, or the file cannot be a
994 directory. Report the unlink problem and fail. */
995 error (0, errno, _("cannot remove %s"),
996 quote (full_filename (filename)));
1002 /* If we don't already know whether FILENAME is a directory,
1003 find out now. Then, if it's a non-directory, we can use
1007 if (cache_statted (st))
1008 is_dir = known_to_be_dir;
1011 if (dp && DT_IS_KNOWN (dp))
1012 is_dir = DT_MUST_BE (dp, DT_DIR);
1015 if (fstatat (fd_cwd, filename, st, AT_SYMLINK_NOFOLLOW))
1017 if (errno == ENOENT && x->ignore_missing_files)
1020 error (0, errno, _("cannot remove %s"),
1021 quote (full_filename (filename)));
1025 is_dir = !! S_ISDIR (st->st_mode);
1031 /* At this point, barring race conditions, FILENAME is known
1032 to be a non-directory, so it's ok to try to unlink it. */
1033 DO_UNLINK (fd_cwd, filename, x);
1035 /* unlink failed with some other error code. report it. */
1036 error (0, errno, _("cannot remove %s"),
1037 quote (full_filename (filename)));
1043 error (0, EISDIR, _("cannot remove %s"),
1044 quote (full_filename (filename)));
1048 if (is_empty_directory == T_YES)
1050 DO_RMDIR (fd_cwd, filename, x);
1051 /* Don't diagnose any failure here.
1052 It'll be detected when the caller tries another way. */
1056 return RM_NONEMPTY_DIR;
1059 /* Given FD_CWD, the file descriptor for an open directory,
1060 open its subdirectory F (F is already `known' to be a directory,
1061 so if it is no longer one, someone is playing games), return a DIR*
1062 pointer for F, and put F's `stat' data in *SUBDIR_SB.
1063 Upon failure give a diagnostic and return NULL.
1064 If PREV_ERRNO is nonzero, it is the errno value from a preceding failed
1065 unlink- or rmdir-like system call -- use that value instead of ENOTDIR
1066 if an opened file turns out not to be a directory. This is important
1067 when the preceding non-dir-unlink failed due to e.g., EPERM or EACCES.
1068 The caller must use a nonnnull CWD_ERRNO the first
1069 time this function is called for each command-line-specified directory.
1070 If CWD_ERRNO is not null, set *CWD_ERRNO to the appropriate error number
1071 if this function fails to restore the initial working directory.
1072 If it is null, report an error and exit if the working directory
1075 fd_to_subdirp (int fd_cwd, char const *f,
1076 struct rm_options const *x, int prev_errno,
1077 struct stat *subdir_sb, Dirstack_state *ds,
1078 int *cwd_errno ATTRIBUTE_UNUSED)
1080 int open_flags = O_RDONLY | O_NOCTTY | O_NOFOLLOW | O_NONBLOCK;
1081 int fd_sub = openat_permissive (fd_cwd, f, open_flags, 0, cwd_errno);
1083 /* Record dev/ino of F. We may compare them against saved values
1084 to thwart any attempt to subvert the traversal. They are also used
1085 to detect directory cycles. */
1086 if (fd_sub < 0 || fstat (fd_sub, subdir_sb) != 0)
1089 close_preserve_errno (fd_sub);
1093 if (! S_ISDIR (subdir_sb->st_mode))
1095 errno = prev_errno ? prev_errno : ENOTDIR;
1096 close_preserve_errno (fd_sub);
1100 DIR *subdir_dirp = fdopendir (fd_sub);
1101 if (subdir_dirp == NULL)
1103 close_preserve_errno (fd_sub);
1110 /* Remove entries in the directory open on DIRP
1111 Upon finding a directory that is both non-empty and that can be chdir'd
1112 into, return RM_OK and set *SUBDIR and fill in SUBDIR_SB, where
1113 SUBDIR is the malloc'd name of the subdirectory if the chdir succeeded,
1114 NULL otherwise (e.g., if opendir failed or if there was no subdirectory).
1115 Likewise, SUBDIR_SB is the result of calling lstat on SUBDIR.
1116 Return RM_OK if all entries are removed. Return RM_ERROR if any
1117 entry cannot be removed. Otherwise, return RM_USER_DECLINED if
1118 the user declines to remove at least one entry. Remove as much as
1119 possible, continuing even if we fail to remove some entries. */
1120 static enum RM_status
1121 remove_cwd_entries (DIR **dirp,
1122 Dirstack_state *ds, char **subdir, struct stat *subdir_sb,
1123 struct rm_options const *x)
1125 struct AD_ent *top = AD_stack_top (ds);
1126 enum RM_status status = top->status;
1127 size_t n_unlinked_since_opendir_or_last_rewind = 0;
1129 assert (VALID_STATUS (status));
1134 struct dirent const *dp;
1135 enum RM_status tmp_status;
1138 /* Set errno to zero so we can distinguish between a readdir failure
1139 and when readdir simply finds that there are no more entries. */
1141 dp = readdir_ignoring_dot_and_dotdot (*dirp);
1148 else if (NEED_REWIND (n_unlinked_since_opendir_or_last_rewind))
1150 /* Call rewinddir if we've called unlink or rmdir so many times
1151 (since the opendir or the previous rewinddir) that this
1152 NULL-return may be the symptom of a buggy readdir. */
1154 n_unlinked_since_opendir_or_last_rewind = 0;
1162 /* Skip files we've already tried/failed to remove. */
1163 if ( ! AD_is_removable (ds, f))
1166 /* Pass dp->d_type info to remove_entry so the non-glibc
1167 case can decide whether to use unlink or chdir.
1168 Systems without the d_type member will have to endure
1169 the performance hit of first calling lstat F. */
1170 cache_stat_init (subdir_sb);
1171 tmp_status = remove_entry (dirfd (*dirp), ds, f, subdir_sb, x, dp);
1175 /* Count how many files we've unlinked since the initial
1176 opendir or the last rewinddir. On buggy systems, if you
1177 remove too many, readdir returns NULL even though there
1178 remain unprocessed directory entries. */
1179 ++n_unlinked_since_opendir_or_last_rewind;
1183 case RM_USER_DECLINED:
1184 AD_mark_as_unremovable (ds, f);
1185 UPDATE_STATUS (status, tmp_status);
1188 case RM_NONEMPTY_DIR:
1190 DIR *subdir_dirp = fd_to_subdirp (dirfd (*dirp), f,
1191 x, errno, subdir_sb, ds, NULL);
1192 if (subdir_dirp == NULL)
1196 /* CAUTION: this test and diagnostic are identical to
1197 those following the other use of fd_to_subdirp. */
1198 if (errno == ENOENT && x->ignore_missing_files)
1200 /* With -f, don't report "file not found". */
1204 /* Upon fd_to_subdirp failure, try to remove F directly,
1205 in case it's just an empty directory. */
1206 int saved_errno = errno;
1207 if (unlinkat (dirfd (*dirp), f, AT_REMOVEDIR) == 0)
1210 error (0, saved_errno,
1211 _("cannot remove %s"), quote (full_filename (f)));
1214 if (status == RM_ERROR)
1215 AD_mark_as_unremovable (ds, f);
1219 *subdir = xstrdup (f);
1220 if (closedir (*dirp) != 0)
1222 error (0, 0, _("failed to close directory %s"),
1223 quote (full_filename (".")));
1226 *dirp = subdir_dirp;
1232 /* Record status for this directory. */
1233 UPDATE_STATUS (top->status, status);
1239 /* Ensure that *dirp is not NULL and that its file descriptor is valid. */
1240 assert (*dirp != NULL);
1241 assert (0 <= fcntl (dirfd (*dirp), F_GETFD));
1246 /* Do this after each call to AD_push or AD_push_initial.
1247 Because the status = RM_OK bit is too remove-specific to
1248 go into the general-purpose AD_* package. */
1249 #define AD_INIT_OTHER_MEMBERS() \
1252 AD_stack_top(ds)->status = RM_OK; \
1256 /* Remove the hierarchy rooted at DIR.
1257 Do that by changing into DIR, then removing its contents, then
1258 returning to the original working directory and removing DIR itself.
1259 Don't use recursion. Be careful when using chdir ".." that we
1260 return to the same directory from which we came, if necessary.
1261 Return an RM_status value to indicate success or failure. */
1263 static enum RM_status
1264 remove_dir (int fd_cwd, Dirstack_state *ds, char const *dir,
1265 struct stat *dir_st,
1266 struct rm_options const *x, int *cwd_errno)
1268 enum RM_status status;
1270 /* There is a race condition in that an attacker could replace the nonempty
1271 directory, DIR, with a symlink between the preceding call to rmdir
1272 (unlinkat, in our caller) and fd_to_subdirp's openat call. But on most
1273 systems, even those without openat, this isn't a problem, since we ensure
1274 that opening a symlink will fail, when that is possible. Otherwise,
1275 fd_to_subdirp's fstat, along with the `fstat' and the dev/ino
1276 comparison in AD_push ensure that we detect it and fail. */
1278 DIR *dirp = fd_to_subdirp (fd_cwd, dir, x, 0, dir_st, ds, cwd_errno);
1282 /* CAUTION: this test and diagnostic are identical to
1283 those following the other use of fd_to_subdirp. */
1284 if (errno == ENOENT && x->ignore_missing_files)
1286 /* With -f, don't report "file not found". */
1290 /* Upon fd_to_subdirp failure, try to remove DIR directly,
1291 in case it's just an empty directory. */
1292 int saved_errno = errno;
1293 if (unlinkat (fd_cwd, dir, AT_REMOVEDIR) == 0)
1296 error (0, saved_errno,
1297 _("cannot remove %s"), quote (full_filename (dir)));
1303 if (ROOT_DEV_INO_CHECK (x->root_dev_ino, dir_st))
1305 ROOT_DEV_INO_WARN (full_filename (dir));
1307 goto closedir_and_return;
1310 AD_push (dirfd (dirp), ds, dir, dir_st);
1311 AD_INIT_OTHER_MEMBERS ();
1317 char *subdir = NULL;
1318 struct stat subdir_sb;
1319 enum RM_status tmp_status;
1321 tmp_status = remove_cwd_entries (&dirp, ds, &subdir, &subdir_sb, x);
1323 if (tmp_status != RM_OK)
1325 UPDATE_STATUS (status, tmp_status);
1326 AD_mark_current_as_unremovable (ds);
1330 AD_push (dirfd (dirp), ds, subdir, &subdir_sb);
1331 AD_INIT_OTHER_MEMBERS ();
1337 /* Execution reaches this point when we've removed the last
1338 removable entry from the current directory. */
1340 /* The name of the directory that we have just processed,
1341 nominally removing all of its contents. */
1344 AD_pop_and_chdir (&dirp, ds, &empty_dir);
1345 int fd = (dirp != NULL ? dirfd (dirp) : AT_FDCWD);
1346 assert (dirp != NULL || AD_stack_height (ds) == 1);
1348 /* Try to remove EMPTY_DIR only if remove_cwd_entries succeeded. */
1349 if (tmp_status == RM_OK)
1351 /* This does a little more work than necessary when it actually
1352 prompts the user. E.g., we already know that D is a directory
1353 and that it's almost certainly empty, yet we lstat it.
1354 But that's no big deal since we're interactive. */
1355 struct stat empty_st;
1357 cache_stat_init (&empty_st);
1358 enum RM_status s = prompt (fd, ds, empty_dir, &empty_st, x,
1359 PA_REMOVE_DIR, &is_empty);
1365 goto closedir_and_return;
1368 if (unlinkat (fd, empty_dir, AT_REMOVEDIR) == 0)
1371 printf (_("removed directory: %s\n"),
1372 quote (full_filename (empty_dir)));
1376 error (0, errno, _("cannot remove directory %s"),
1377 quote (full_filename (empty_dir)));
1378 AD_mark_as_unremovable (ds, empty_dir);
1380 UPDATE_STATUS (AD_stack_top(ds)->status, status);
1386 if (AD_stack_height (ds) == 1)
1391 /* If the first/final hash table of unremovable entries was used,
1395 closedir_and_return:;
1396 if (dirp != NULL && closedir (dirp) != 0)
1398 error (0, 0, _("failed to close directory %s"),
1399 quote (full_filename (".")));
1406 /* Remove the file or directory specified by FILENAME.
1407 Return RM_OK if it is removed, and RM_ERROR or RM_USER_DECLINED if not. */
1409 static enum RM_status
1410 rm_1 (Dirstack_state *ds, char const *filename,
1411 struct rm_options const *x, int *cwd_errno)
1413 char const *base = last_component (filename);
1414 if (dot_or_dotdot (base))
1416 error (0, 0, _(base == filename
1417 ? "cannot remove directory %s"
1418 : "cannot remove %s directory %s"),
1419 quote_n (0, base), quote_n (1, filename));
1424 cache_stat_init (&st);
1425 if (x->root_dev_ino)
1427 if (cache_fstatat (AT_FDCWD, filename, &st, AT_SYMLINK_NOFOLLOW) != 0)
1429 if (errno == ENOENT && x->ignore_missing_files)
1431 error (0, errno, _("cannot remove %s"), quote (filename));
1434 if (SAME_INODE (st, *(x->root_dev_ino)))
1436 error (0, 0, _("cannot remove root directory %s"), quote (filename));
1441 AD_push_initial (ds);
1442 AD_INIT_OTHER_MEMBERS ();
1444 int fd_cwd = AT_FDCWD;
1445 enum RM_status status = remove_entry (fd_cwd, ds, filename, &st, x, NULL);
1446 if (status == RM_NONEMPTY_DIR)
1448 /* In the event that remove_dir->remove_cwd_entries detects
1449 a directory cycle, arrange to fail, give up on this FILE, but
1450 continue on with any other arguments. */
1451 if (setjmp (ds->current_arg_jumpbuf))
1454 status = remove_dir (fd_cwd, ds, filename, &st, x, cwd_errno);
1456 AD_stack_clear (ds);
1464 /* Remove all files and/or directories specified by N_FILES and FILE.
1465 Apply the options in X. */
1466 extern enum RM_status
1467 rm (size_t n_files, char const *const *file, struct rm_options const *x)
1469 enum RM_status status = RM_OK;
1470 Dirstack_state *ds = ds_init ();
1474 for (i = 0; i < n_files; i++)
1476 if (cwd_errno && IS_RELATIVE_FILE_NAME (file[i]))
1478 error (0, 0, _("cannot remove relative-named %s"), quote (file[i]));
1483 cycle_check_init (&ds->cycle_check_state);
1484 enum RM_status s = rm_1 (ds, file[i], x, &cwd_errno);
1485 assert (VALID_STATUS (s));
1486 UPDATE_STATUS (status, s);
1489 if (x->require_restore_cwd && cwd_errno)
1491 error (0, cwd_errno,
1492 _("cannot restore current working directory"));