Make a failing cross-partition mv give a sensible diagnostic.

A cross-partition move of a file in a sticky tmpdir and owned by
another user would evoke an invalid diagnostic after copying it:

  mv: cannot remove `x': Operation not permitted

Either of the following (mv.c, remove.c) changes would fix the bug by
itself.  I think it's slightly better to use both; the added cost is
minimal: mv: an extra lstat-per-mv-cmdline-arg-that-goes-cross-partition,
rm: an extra lstat-per-unlink-that-fails-w/EPERM.
* src/remove.c (remove_entry): Also lstat the file upon EPERM.
* src/mv.c (rm_option_init): Initialize root_dev_ino just as is done
in rm, so that a cross-partition invoked remove.c:rm call works the
same way as one invoked from the command-line use of "rm".  That
setting of root_dev_ino makes rm() do the equivalent of an additional
lstat for each argument, which in turn gives rm enough information to
issue the right diagnostic.
* tests/mv/sticky-to-xpart (version): New file.  Test for the above.
* tests/mv/Makefile.am (TESTS): Add sticky-to-xpart.
Arrange for "make check-root" to run the new root-only test.
* tests/Makefile.am (tb): New target, to run the new root-only test.
(all_t): Add tb.
* src/c99-to-c89.diff: Adjust offsets.

3 files changed, 14 insertions, 5 deletions

diff --git a/src/c99-to-c89.diff b/src/c99-to-c89.diff
index 01e213beb..8a3737247 100644
--- a/src/c99-to-c89.diff
+++ b/src/c99-to-c89.diff
@@ -42,7 +42,7 @@ diff -upr src/remove.c src/remove.c
 
        if (!yesno ())
  	return RM_USER_DECLINED;
-@@ -1533,6 +1537,7 @@ rm_1 (Dirstack_state *ds, char const *fi
+@@ -1534,6 +1538,7 @@ rm_1 (Dirstack_state *ds, char const *fi
        return RM_ERROR;
      }
 
@@ -50,7 +50,7 @@ diff -upr src/remove.c src/remove.c
    struct stat st;
    cache_stat_init (&st);
    cycle_check_init (&ds->cycle_check_state);
-@@ -1555,6 +1560,7 @@ rm_1 (Dirstack_state *ds, char const *fi
+@@ -1556,6 +1561,7 @@ rm_1 (Dirstack_state *ds, char const *fi
    AD_push_initial (ds);
    AD_INIT_OTHER_MEMBERS ();
 
@@ -58,7 +58,7 @@ diff -upr src/remove.c src/remove.c
    enum RM_status status = remove_entry (AT_FDCWD, ds, filename,
  					DT_UNKNOWN, &st, x);
    if (status == RM_NONEMPTY_DIR)
-@@ -1573,6 +1579,8 @@ rm_1 (Dirstack_state *ds, char const *fi
+@@ -1574,6 +1580,8 @@ rm_1 (Dirstack_state *ds, char const *fi
    ds_clear (ds);
    return status;
  }
diff --git a/src/mv.c b/src/mv.c
index 1834f4c64..8b70d0048 100644
--- a/src/mv.c
+++ b/src/mv.c
@@ -32,6 +32,7 @@
 #include "filenamecat.h"
 #include "quote.h"
 #include "remove.h"
+#include "root-dev-ino.h"
 
 /* The official name of this program (e.g., no `g' prefix).  */
 #define PROGRAM_NAME "mv"
@@ -92,7 +93,6 @@ static void
 rm_option_init (struct rm_options *x)
 {
   x->ignore_missing_files = false;
-  x->root_dev_ino = NULL;
   x->recursive = true;
   x->one_file_system = false;
 
@@ -108,6 +108,14 @@ rm_option_init (struct rm_options *x)
      the initial working directory, in case one of those is a
      `.'-relative name.  */
   x->require_restore_cwd = true;
+
+  {
+    static struct dev_ino dev_ino_buf;
+    x->root_dev_ino = get_root_dev_ino (&dev_ino_buf);
+    if (x->root_dev_ino == NULL)
+      error (EXIT_FAILURE, errno, _("failed to get attributes of %s"),
+	     quote ("/"));
+  }
 }
 
 static void
diff --git a/src/remove.c b/src/remove.c
index ac1010953..3cbfe6683 100644
--- a/src/remove.c
+++ b/src/remove.c
@@ -1082,7 +1082,8 @@ remove_entry (int fd_cwd, Dirstack_state const *ds, char const *filename,
 
       if (! x->recursive
 	  || (cache_stat_ok (st) && !S_ISDIR (st->st_mode))
-	  || (errno == EACCES && is_nondir_lstat (fd_cwd, filename, st))
+	  || ((errno == EACCES || errno == EPERM)
+	      && is_nondir_lstat (fd_cwd, filename, st))
 	  )
 	{
 	  if (ignorable_missing (x, errno))