Subject: Re: kern/1043: unlink(2) should not let superuser remove directories
To: None <netbsd-bugs@NetBSD.ORG>
From: Christos Zoulas <christos@deshaw.com>
List: netbsd-bugs
Date: 05/15/1995 13:04:00
In article <199505150132.UAA23724@bonkers.taronga.com> peter@bonkers.taronga.com (Peter da Silva) writes:
>
>If that's the only thing wrong with the file system, I'd rather use link
>and unlink and clri and fsck than dive into fdsb... and I've been doing
>this for fifteen years. Fsdb will let you totally screw your filesystem
>to the point where you have to reinstall faster than you can say jack
>robinson. Fsdb is a tool of last resort, like using adb on a running
>kernel (which I've done too, now that I think of it). Link and unlink
>take some effort to produce that level of brokenness... because they work
>through the file system, and won't *create* half-broken inodes if there
>aren't any there already.
>
>In any case, I have real strong philosophical problems with removing the
>ability of root to do *anything*... not just link and unlink directories.
>

Well, although I agree with you I would like to bring up the following
example:

I year ago I had to fix pmake, so that it would not call unlink() blindly
on the make targets when it was interrupted. So, in before every call to
unlink, I had to stat the file and then call unlink only if it was *not*
a directory. This bug had been in pmake since it was written in 1987-1988
and it was fixed in 1993-1994, when 4.4BSD started becoming more popular
and somebody either looked at the code or figured out the relationship
of hitting ^C during makes and losing directories.

Can you guarantee that there is no code right now in the tree that you
can coerce to remove directories?

christos