Revert r330897:

This was intended to be a non-functional change. It wasn't. The commit
message was thus wrong. In addition it broke arm, and merged crypto
related code.

Revert with prejudice.

This revert skips files touched in r316370 since that commit was since
MFCed. This revert also skips files that require $FreeBSD$ property
changes.

Thank you to those who helped me get out of this mess including but not
limited to gonzo, kevans, rgrimes.

Requested by: gjb (re)

Partial merge of the SPDX changes

These changes are incomplete but are making it difficult
to determine what other changes can/should be merged.

No objections from: pfg

MFC r325450:

Fix cosmetic nit when printing out "override $mode" and "$owner/$group ..."

The wrong index was being checked for == ' ' in the resulting stringified
mode from strmode(3) -- it should have been the 11th value, not the 10th.

PR: 76711

Copy head@r302406 to stable/11 as part of the 11.0-RELEASE cycle.
Prune svn:mergeinfo from the new branch, as nothing has been merged
here.

Additional commits post-branch will follow.

Approved by: re (implicit)
Sponsored by: The FreeBSD Foundation

Protecting against rm -rf / is now POSIXLY_CORRECT per posix 1003.1
edition 2013. No need anymore to disable the protection if one set
the POXILY_CORRECT environment variable.

Reviewed by: imp
MFC after: 3 days
Differential Revision: https://reviews.freebsd.org/D4092

Respect locale settings.

MFC after: 2 weeks

rm -rf can fail sometimes with an error from fts_read. Make it honor
fflag to ignore fts_read errors, but stop deleting from that directory
because no further progress can be made.

When building a kernel with a high -j value on a high core count
machine, during the cleanobj phase we can wind up doing multiple rm
-rf at the same time for modules that have subdirectories. This
exposed this race (sometimes) as fts_read can return an error if the
directory is removed by another rm -rf. Since the intent of the -f
flag was to ignore errors, even if this was a bug in fts_read, we
should ignore the error like we've been instructed to do.

Add two more 'static' qualifiers

Take some improvements from DragonFlyBSD:
- add const where appropriate
- add static where appropriate
- fix a whitespace issues

Reviewed by: brooks
Obtained from: DragonFlyBSD
MFC After: 1 week

Add -x option to avoid crossing mount points when removing a hierarchy.

Discussed on: -hackers
Inspired by: DragonflyBSD
MFC After: 1 week

Fix bin/ build with a 64-bit ino_t.

Original code by: Gleb Kurtsou

Polish previous revision: if the fts_* routines have lstat()'ed the
directory entry then use the struct stat from that instead of doing
it again, and skip the rm_overwrite() call if fts_read() indicated
that the entry couldn't be a regular file.

Obtained from: OpenBSD
MFC after: 1 week

Fix potential symlink race condition in "rm -P" by adding a check
that the file we have opened is the one we expected. Also open in
non-blocking mode to avoid a potential hang with FIFOs.

Obtained from: NetBSD via OpenBSD

Put some static keywords in the source code.

For these simple utilities, it doesn't harm to make all global variables
static. In fact, this allows the compiler to perform better forms of
optimisation and analysis.

bin: Prefer strrchr() to rindex().

This removes the last index/rindex usage from /bin.

rm(1): clarify that -P works only when blocks are updated in-place

Suggested by: pjd, ivoras, arundel

rm, find -delete: fix removing symlinks with uchg/uappnd set.

Formerly, this tried to clear the flags on the symlink's target
instead of the symlink itself.

As before, this only happens for root or for the unlink(1) variant of rm.

PR: bin/111226 (part of)
Submitted by: Martin Kammerhofer
Approved by: ed (mentor)
MFC after: 3 weeks

Implement ^T support for rm: now it will report the next file it
removes when you hit ^T. This is similar to what's done for cp. The
signal handler and type definitions for "info" were borrowed directly
from cp.

Correct a security issue introduced in previous commit:
instead of removing the file and issue a warning about
the removal, do not do any operation at all in case -P
is specified when the dinode has hard links.

With -f and -P specified together, we assume that the
user wants rm to overwrite the contents of the file
and remove it (destroy the contents of file but leave
its hard links as is).

The reason of doing it this way is that, in case where
a hard link is created by a malicious user (currently
this is permitted even if the user has no access to the
file). Losing the link can potentially mean that the
actual owner would lose control completely to the user
who wants to obtain access in a future day.

Discussed with: Peter Jermey

Be more reasonable when overwrite mode is specified while there
is hard links. Overwritting when links > 1 would cause data
loss, which is usually undesired.

Inspired by: discussion on -hackers@
Suggested by: elessar at bsdforen de
Obtained from: OpenBSD

o Backout rev. 1.55. Don't waste cpu cycles for bzero(), do not
call chflags() for whiteouted files.

Prodded by: ru

o Zero out struct stat before usage. lstat(2) can fail and
leave garbage there which will break -W code path.

PR: bin/84569
Submitted by: Igor
MFC after: 2 weeks

o Be pedantic and do fts_close() when done.

PR: bin/95292
Submitted by: Charles Hardin
Obtained from: NetBSD via OpenBSD, PR

Handle the case where the -P flag is specified for a read-only file
earlier, and more gracefully. Previously, this combination would be
ignored early in the code where permissions are tested and fail later
with a very unhelpful "permission denied" error.

Instead, test for this flag in the same block that generates the
"override?" messages for read-only files, but instead of trying
to guess what the user has in mind, generate an error and exit.

Update the man page to reflect this new behavior.

Not objected to by: freebsd-hackers@

UNIX conformance: If -r -f on non-existent directory, don't emit error.

Add -I, an option that asks for confirmation once if recursively
removing directories or if more than 3 files are listed in the
command line.

This feature is intended to provide a safe net but not being too
annoying like having "rm -i" for every deleting operations, and
is generally good for both newbies and power users, preventing
them from being so easily run into ``rm -rf /'', ``rm -rf *''
and so forth.

Originally implemented by Matthew Dillon for DragonFly, plus
some improvements done by various DragonFly contributors.

Approved by: murray (mentor; the original dillon's version)
Discussed with: des
Obtained from: DragonFly's bin/rm/
rm.c rev. 1.4 - 1.8
rm.1 rev. 1.3 - 1.4
MFC After: 1 month

The previous commit added code to rm(1) to warn about and remove any
occurrences of "/" in the argument list. This corresponds to Enhancement
Request Number 5 in the Austin Group TC2 Aardvark's XCU Defects Report
(<URL:http://www.opengroup.org/austin/aardvark/finaltext/xcubug.txt>).
Further discussion is available in the Austin Group mailing list archives
(<URL:http://www.opengroup.org/austin/mailarchives/>, "Defect in XCU rm")
and for Austin Group members, in the Austin Group Interpretations archive
(<URL:http://www.opengroup.org/austin/interps/>, AI-019)

This commit makes that check conditional on !POSIXLY_CORRECT, since it
is not strictly correct according to the current version of the standard
(but is expected to be correct according to the next version, and has
already been adopted by Solaris).

Find out how flame-proof my underwear really is.

Whitespace cleanup.

Remove clause 3 from the UCB licenses.

OK'ed by: imp, core

o Fix a style bug and poor wording in comment.
o When fts_read() cannot stat the file, it can't be unlinked. At
that case, don't display error message when -f flag is used.

Obtained from: bde
PR: kern/16815, bin/35842
Reported by: kuriyama, Aleksandr A. Babaylov <.@babolo.ru>

When the P flag is set (i.e. Overwrite regular files before deleting them),
do only unlink the file if we could indeed overwrite the file.
Old behaviour: rm -P /tmp/foo (foo mode 0444) would NOT overwrite foo,
but still delete it (with a warning: rm: foo: Permission denied)
New behaviour: Just the EPERM warning, but no deletion

Reviewed by: bde

1. Fixed leakage of a file descriptor for every non-fatal failure in
rm_overwrite() (for rm -P).

2. Print the file name in the error message for (fatal) malloc() failures
in rm_overwrite(). I first thought that malloc() failures should be
non-fatal since they don't prevent proceeding the the next file, but
making them non-fatal would normally give too much output for rm -Pr
on a large tree in the unlikely event that even one occurs, since the
malloc()ed amounts are usually the same. Just print the file name since
the malloc()ed amounts are not always the same and it doesn't hurt to
know where rm was when it quit.

Submitted by: guido ((1) and original version of (2))

Quiet warnings about copyright[].

s/filesystem/file system/ as discussed on -developers

Complain if more than one file argument is given to unlink(1) like we did
before I made unlink use getopt().

err() is documented as allowing NULL for the format string but GCC isn't
happy about it any more so change the usage to make buildworld work again.

Consistently use FBSDID

Reject options, handle "--" correctly in unlink(1).

Consistancy check s/file system/filesystem/

Reviewed by: brian

Move user_from_uid to pwd.h
Move group_from_gid to grp.h
Remove from stdlib.h
Make the prototypes match the code
Fix rm and mv to include new files.

NetBSD has these defined in those files, and others too that I've not
done.

Approved by: terminal room kabal
Reviewed by: jhb, phk

o __P has been reoved
o Old-style K&R declarations have been converted to new C89 style
o register has been removed
o prototype for main() has been removed (gcc3 makes it an error)
o int main(int argc, char *argv[]) is the preferred main definition.
o Attempt to not break style(9) conformance for declarations more than
they already are.

Add prototypes for main() so that these programs compile with -Werror
(which somehow now seems to be the default for compiling -current).
This error popped up while doing a PicoBSD cross-compile on a 4.3-ish system,
it may well be that there are other apps which have similar problems,
but I did not spot them as they are not included in my picobsd config.

Whether adding prototypes for main() is the correct solution or not
I have no idea, a request to -current on the matter went basically
unanswered. Those who have better ideas are welcome to back this out
and replace it with the correct fix.

Removed wrong cast for fts_open()'s third argument.

Display pathname of item being rm'ed.

Submitted by: Peter Pentchev <roam@orbitel.bg>

Switch over to using the new fflagstostr and strtofflags library calls.

Remove unused #include.

Revert part of the last commit, remove {g|s}etflags from the libc
interface, and statically link them to the programs using them.
These functions, upon reflection and discussion, are too generically
named for a library interface with such specific functionality.
Also the api that they use, whilst ok for private use, isn't good
enough for a libc function.

Additionally there were complications with the build/install-world
process. It depends heavily upon xinstall, which got broken by
the change in api, and caused bootstrap problems and general mayhem.

There is work in progress to address future problems that may be
caused by changes in install-chain tools, and better names for
{g|s}etflags can be derived when some future program requires them.
For now the code has been left in src/lib/libc/gen (it started off
in src/bin/ls).

It's important to provide library functions for manipulating file
flag strings if we ever want this interface to be adopted outside
of the source tree, but now isn't necessarily the right moment
with 4.0-release just around the corner.

Approved: jkh

Historically file flags (schg, uschg, etc) have been converted from
string to u_long and back using two functions, flags_to_string and
string_to_flags, which co-existed with 'ls'. As time has progressed
more and more other tools have used these private functions to
manipulate the file flags.

Recently I moved these functions from /usr/src/bin/ls to libutil,
but after some discussion with bde it's been decided that they
really ought to go in libc.

There are two already existing libc functions for manipulating file
modes: setmode and getmode. In keeping with these flags_to_string
has been renamed getflags and string_to_flags to setflags.

The manual page could probably be improved upon ;)

Add link(1) and unlink(1) as special cases of ln(1) and rm(1)
respectively, in accordance with SUSv2.

This differs from the approach taken in NetBSD, but provides
less obscure error messages in at least the EISDIR case and
does not take up additional disk space for new binaries.

PR: 13071
PR: 13074
Requested by: James Howard <howardjp@wam.umd.edu>

brucify

Reviewed by: obrien

Fixed longstanding breakage of rm of deep directories in rev.1.2.
rm must not use FTS_NOCHDIR, since chdir'ing is required for removing
deep directory trees and the ability to remove such trees is required
by POSIX.2 and POLA. The breakage didn't make much difference until
recently, since fts(3) didn't work in deep directory trees. It isn't
clear whether using FTS_NOCHDIR ever fixed anything (Net/2's rm.c is
similar to Lite1's). Perhaps it was actually to limit the damage
caused by the fts bug.

brucify, `v' before `W', mention -v is non-standard in manpage and
make code slightly easier to read

Reviewed by: obrien

fix rm -r

Submitted by: John Hay -- John.Hay@mikom.csir.co.za

add verbose flag
exit(1) --> exit(EX_USAGE)

Reviewed by: obrien

$Id$ -> $FreeBSD$

Use .Dq instead of ``'' in manpage
Use optimal blocksize for rm -P, instead of always using 8192-byte blocks
to overwrite the file.

Obtained from: OpenBSD

Don't emit usage() message when no arguments given to -f. This
appears to be consistent with other Unixen, like Solaris.

PR: 10240
Submitted by: jun_sun@hlla.is.tsukuba.ac.jp

Remove remaining Lite1 stuff from the man page and uphold the
precedence in changing sccsid to rcsid as set by Phillippe
Charnier in his previous 100 or so commits.

pointed out by: Bruce Evans <bde@zeta.org.au>

Remove #if(n)def BSD_4_4_LITE cruft and change sccsid to rcsid.

Enable whiteout code since we now have the lite2 support for them.

compare return value from getopt against -1 rather than EOF, per the final
posix standard on the topic.

Revert $FreeBSD$ to $Id$

Make the long-awaited change from $Id$ to $FreeBSD$

This will make a number of things easier in the future, as well as (finally!)
avoiding the Id-smashing problem which has plagued developers for so long.

Boy, I'm glad we're not using sup anymore. This update would have been
insane otherwise.

Merge Lite2 mods, and -Wall cleaning. Unimplemented undelete(2)
cruft is protected by a #ifdef (BSD4_4_LITE) that should be
removed when this is supported by the kernel.

fix usage string
respond `Y' is equal to `y'

Add a note how to delete file name with beginning `-'

Don't initialize udata, fix usage string

delete my last commit
Submitted by: pst, ache

Remove unnecessary '?' case and don't zero global udata, it's already zero

update usage string
all flag variables initialized with zero
respond `Y' is equal to `y'

Allow root to delete uchg/uappnd files

Added $Id$

Remove redundant declarations that were added in the previous commit.

Applied patch to make -Wall and -Dlint shut up.

Reviewed by: phk
Submitted by: Josef Grosch <joeg@gagme.wwa.com>

Reviewed by:
Submitted by:
Added the FTS_NOCHDIR flag to the fts-open call. This is needed, so that
the fts don't change the current directory for rm and subsequent calls
to rmdir with relative pathnames don't fail.
Pulled over the bugfix in 1.1.5.

This commit was generated by cvs2svn to compensate for changes in r1556,
which included commits to RCS files with non-trunk default branches.

BSD 4.4 Lite bin Sources