new feature: rm accepts new option: --one-file-system

Suggested by Steve McIntyre in <http://bugs.debian.org/392925>.
* src/remove.h (struct rm_options) [one_file_system]: New member.
* src/rm.c (rm_option_init): Initialize it.
(usage): Document the option.
* src/mv.c (rm_option_init): Likewise.
* src/remove.c (remove_dir): With --one-file-system and --recursive,
for each directory command line argument, do not affect a file system
different from that of the starting directory.  And give a diagnostic.
* src/rm.c (ONE_FILE_SYSTEM): New enum.
(main): Handle new option.
* tests/rm/one-file-system: Test the above.
* tests/rm/Makefile.am (TESTS): Add one-file-system.
* tests/Makefile.am (check-root): Add the rm/one-file-system
test to the list.
(EXTRA_DIST): Add other-fs-tmpdir.

* tests/mv/setup: Removed.  Renamed to...
* tests/other-fs-tmpdir: ...this new file.
* tests/mv/Makefile.am (EXTRA_DIST): Remove setup.
* tests/mv/acl: Reflect renaming: use ../other-fs-tmpdir.
* tests/mv/backup-is-src: Likewise.
* tests/mv/hard-link-1: Likewise.
* tests/mv/leak-fd: Likewise.
* tests/mv/mv-special-1: Likewise.
* tests/mv/part-fail: Likewise.
* tests/mv/part-hardlink: Likewise.
* tests/mv/part-rename: Likewise.
* tests/mv/part-symlink: Likewise.
* tests/mv/partition-perm: Likewise.
* tests/mv/to-symlink: Likewise.
* tests/mv/into-self-2: Likewise.

[doc/ChangeLog]
* coreutils.texi (rm invocation): Describe --one-file-system.

4 files changed, 42 insertions, 4 deletions

diff --git a/src/mv.c b/src/mv.c
index 299a6acfd..03e96e5a0 100644
--- a/src/mv.c
+++ b/src/mv.c
@@ -94,6 +94,7 @@ rm_option_init (struct rm_options *x)
   x->ignore_missing_files = false;
   x->root_dev_ino = NULL;
   x->recursive = true;
+  x->one_file_system = false;
 
   /* Should we prompt for removal, too?  No.  Prompting for the `move'
      part is enough.  It implies removal.  */
diff --git a/src/remove.c b/src/remove.c
index d362db0ee..add85dd7b 100644
--- a/src/remove.c
+++ b/src/remove.c
@@ -1298,6 +1298,7 @@ remove_dir (int fd_cwd, Dirstack_state *ds, char const *dir,
 	    struct rm_options const *x, int *cwd_errno)
 {
   enum RM_status status;
+  dev_t current_dev = dir_st->st_dev;
 
   /* There is a race condition in that an attacker could replace the nonempty
      directory, DIR, with a symlink between the preceding call to rmdir
@@ -1359,15 +1360,31 @@ remove_dir (int fd_cwd, Dirstack_state *ds, char const *dir,
 	}
       if (subdir)
 	{
-	  AD_push (dirfd (dirp), ds, subdir, &subdir_sb);
-	  AD_INIT_OTHER_MEMBERS ();
+	  if ( ! x->one_file_system
+	       || subdir_sb.st_dev == current_dev)
+	    {
+	      AD_push (dirfd (dirp), ds, subdir, &subdir_sb);
+	      AD_INIT_OTHER_MEMBERS ();
+	      free (subdir);
+	      continue;
+	    }
 
+	  /* Here, --one-file-system is in effect, and with remove_cwd_entries'
+	     traversal into the current directory, (known as SUBDIR, from ..),
+	     DIRP's device number is different from CURRENT_DEV.  Arrange not
+	     to do anything more with this hierarchy.  */
+	  error (0, errno, _("skipping %s, since it's on a different device"),
+		 quote (full_filename (subdir)));
 	  free (subdir);
-	  continue;
+	  AD_mark_current_as_unremovable (ds);
+	  tmp_status = RM_ERROR;
+	  UPDATE_STATUS (status, tmp_status);
 	}
 
       /* Execution reaches this point when we've removed the last
-	 removable entry from the current directory.  */
+	 removable entry from the current directory -- or, with
+	 --one-file-system, when the current directory is on a
+	 different file system.  */
       {
 	/* The name of the directory that we have just processed,
 	   nominally removing all of its contents.  */
diff --git a/src/remove.h b/src/remove.h
index d3609d768..2dc617618 100644
--- a/src/remove.h
+++ b/src/remove.h
@@ -30,6 +30,14 @@ struct rm_options
   /* If true, query the user about whether to remove each file.  */
   bool interactive;
 
+  /* If true, do not traverse into (or remove) any directory that is
+     on a file system (i.e., that has a different device number) other
+     than that of the corresponding command line argument.  Note that
+     even without this option, rm will fail in the end, due to its
+     probable inability to remove the mount point.  But there, the
+     diagnostic comes too late -- after removing all contents.  */
+  bool one_file_system;
+
   /* If true, recursively remove directories.  */
   bool recursive;
 
diff --git a/src/rm.c b/src/rm.c
index 28e09ce12..0c93a040a 100644
--- a/src/rm.c
+++ b/src/rm.c
@@ -72,6 +72,7 @@ char *program_name;
 enum
 {
   INTERACTIVE_OPTION = CHAR_MAX + 1,
+  ONE_FILE_SYSTEM,
   NO_PRESERVE_ROOT,
   PRESERVE_ROOT,
   PRESUME_INPUT_TTY_OPTION
@@ -90,6 +91,7 @@ static struct option const long_opts[] =
   {"force", no_argument, NULL, 'f'},
   {"interactive", optional_argument, NULL, INTERACTIVE_OPTION},
 
+  {"one-file-system", no_argument, NULL, ONE_FILE_SYSTEM},
   {"no-preserve-root", no_argument, NULL, NO_PRESERVE_ROOT},
   {"preserve-root", no_argument, NULL, PRESERVE_ROOT},
 
@@ -170,6 +172,11 @@ Remove (unlink) the FILE(s).\n\
                           always (-i).  Without WHEN, prompt always\n\
 "), stdout);
       fputs (_("\
+      --one-file-system  when removing a hierarchy recursively, skip any\n\
+                          directory that is on a file system different from\n\
+                          that of the corresponding command line argument\n\
+"), stdout);
+      fputs (_("\
       --no-preserve-root  do not treat `/' specially\n\
       --preserve-root   do not remove `/' (default)\n\
   -r, -R, --recursive   remove directories and their contents recursively\n\
@@ -207,6 +214,7 @@ rm_option_init (struct rm_options *x)
 {
   x->ignore_missing_files = false;
   x->interactive = false;
+  x->one_file_system = false;
   x->recursive = false;
   x->root_dev_ino = NULL;
   x->stdin_tty = isatty (STDIN_FILENO);
@@ -299,6 +307,10 @@ main (int argc, char **argv)
 	    break;
 	  }
 
+	case ONE_FILE_SYSTEM:
+	  x.one_file_system = true;
+	  break;
+
 	case NO_PRESERVE_ROOT:
 	  preserve_root = false;
 	  break;