Don't let ln be a party to destroying user data.

* src/ln.c: Include "file-set.h", "hash.h" and "hash-triple.h".
(dest_set, DEST_INFO_INITIAL_CAPACITY): New globals.
(do_link): Refuse to remove a just-created link.
Record a name,dev,ino triple for each link we create.
(main): Initialize dest_set, if needed.
* tests/mv/childproof: Test for the above fix.
* NEWS: Document this.
Reported by Eric Blake.

Signed-off-by: Jim Meyering <jim@meyering.net>

1 files changed, 12 insertions, 5 deletions

diff --git a/NEWS b/NEWS
index c548c0b1b..6a0f18d9a 100644
--- a/NEWS
+++ b/NEWS
@@ -56,6 +56,18 @@ GNU coreutils NEWS                                    -*- outline -*-
   ptx longer accepts the --copyright option.
   who no longer accepts -i or --idle.
 
+** Improved robustness
+
+  ln -f can no longer silently clobber a just-created hard link.
+  In some cases, ln could be seen as being responsible for data loss.
+  For example, given directories a, b, c, and files a/f and b/f, we
+  should be able to do this safely: ln -f a/f b/f c && rm -f a/f b/f
+  However, before this change, ln would succeed, and thus cause the
+  loss of the contents of a/f.
+
+  stty no longer silently accepts certain invalid hex values
+  in its 35-colon commmand-line argument
+
 ** Bug fixes
 
   cp attempts to read a regular file, even if stat says it is empty.
@@ -130,11 +142,6 @@ GNU coreutils NEWS                                    -*- outline -*-
   tr -c no longer aborts when translating with Set2 larger than the
   complement of Set1.  [introduced with the original version, in 1992]
 
-** Improved robustness
-
-  stty no longer silently accepts certain invalid hex values
-  in its 35-colon commmand-line argument
-
 
 * Noteworthy changes in release 6.9 (2007-03-22) [stable]