mv:fix file ownership changes when a file is mv'ed by root to a different file system by mattsu2020 · Pull Request #9672 · uutils/coreutils

mattsu2020 · 2025-12-16T09:47:54Z

Summary

Fix cross-filesystem mv (EXDEV copy+delete fallback) so that file ownership does not change to the invoking user (e.g. root) when moving a file across filesystems.

Fixes #9635.

Background / Problem

When mv cannot rename(2) across devices (EXDEV), uutils falls back to copy+delete. The copy path used std::fs::copy, which creates the destination owned by the caller. If root moves a file owned by another user to a different filesystem, the destination ends up owned by root (compatibility + security concern).

Changes

On Unix, preserve uid/gid and mode after the copy step in the EXDEV fallback:
- regular files (including the hardlink-aware copy path)
- directories (including recursively created subdirectories)
- symlinks (use lchown, do not follow)
- FIFOs
Restore mode after chown to keep correct permission bits (since chown may clear setuid/setgid).
Add a Linux-only regression test that runs only as root and verifies uid/gid are preserved across partitions (/dev/shm tmpfs).
Address clippy (bind_instead_of_map) in the copy path.

Testing

cargo test -p uu_mv
cargo clippy -p uu_mv -- -D warnings

related
#9635

github-actions · 2025-12-16T10:03:41Z

GNU testsuite comparison:

Skipping an intermittent issue tests/tail/overlay-headers (passes in this run but fails in the 'main' branch)

oech3 · 2026-01-01T12:02:12Z

+        .env("BASE", &base)
+        .env("UUTILS", &scene.bin_path)
+        .output()
+        .expect("failed to run unshare");


It might better to create a new function for uhshare (at different PR).
Ref: #9973

github-actions · 2026-01-12T01:01:37Z

GNU testsuite comparison:

Skipping an intermittent issue tests/timeout/timeout (passes in this run but fails in the 'main' branch)

sylvestre · 2026-01-17T15:29:09Z

@@ -816,6 +816,44 @@ fn is_fifo(_filetype: fs::FileType) -> bool {
    false
 }

+#[cfg(unix)]
+fn try_preserve_ownership(from_meta: &fs::Metadata, to: &Path, follow_symlinks: bool) {


document this function please

sylvestre · 2026-01-17T15:29:25Z

+
+    unsafe {
+        if follow_symlinks {
+            let _ = libc::chown(to_cstr.as_ptr(), uid, gid);


please manage the errors

sylvestre · 2026-01-17T15:29:38Z

+}
+
+#[cfg(unix)]
+fn try_preserve_permissions(from_meta: &fs::Metadata, to: &Path) {


same, please document it

sylvestre · 2026-01-17T15:29:45Z

+
+    // Keep mode bits only (file type bits are not allowed in chmod).
+    let mode = from_meta.mode() & 0o7777;
+    let _ = fs::set_permissions(to, fs::Permissions::from_mode(mode));


please manage the error

codspeed-hq · 2026-01-19T12:40:13Z

Merging this PR will not alter performance

✅ 299 untouched benchmarks
⏩ 46 skipped benchmarks¹

_{Comparing mattsu2020:mv_fix (7058753) with main (e0f0318)}

46 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

github-actions · 2026-01-19T12:58:24Z

GNU testsuite comparison:

Skip an intermittent issue tests/tty/tty-eof (fails in this run but passes in the 'main' branch)

sylvestre · 2026-02-10T20:43:09Z

+fn copy_symlink(from: &Path, to: &Path) -> io::Result<()> {
+    let from_meta = from.symlink_metadata()?;
+    let path_symlink_points_to = fs::read_link(from)?;
+    unix::fs::symlink(path_symlink_points_to, to).map(|_| {


it should copy xattrs like rename_symlink_fallback does. no ?

github-actions · 2026-02-10T20:46:37Z

GNU testsuite comparison:

Congrats! The gnu test tests/mv/meta-to-xpart is no longer failing!

github-actions · 2026-02-11T12:17:24Z

GNU testsuite comparison:

GNU test failed: tests/timeout/timeout-group. tests/timeout/timeout-group is passing on 'main'. Maybe you have to rebase?
Congrats! The gnu test tests/mv/meta-to-xpart is no longer failing!

ChrisDryden · 2026-02-12T19:06:03Z

I think we have a chmod helper that we can use here that implements all of the logic in the PR already in the uucore perms lib

sylvestre · 2026-02-12T19:44:22Z

and it conflicts

mattsu2020 · 2026-02-14T07:09:10Z

I think we have a chmod helper that we can use here that implements all of the logic in the PR already in the uucore perms lib

wrap_chown is too high-level for mv compatibility logic. It returns formatted Result<String, String>, so mv cannot inspect errno to implement GNU-like behavior (owner+group attempt, optional group-only fallback, and selective suppression for EPERM/EACCES/EINVAL).

To avoid behavior regressions, I’d like to add a public low-level helper in uucore::perms that returns io::Result<()> (preserving errno), then switch mv to that helper while keeping GNU-compatible branching in mv. This still removes syscall duplication, but without changing user-visible behavior.

github-actions · 2026-02-14T11:33:12Z

GNU testsuite comparison:

GNU test failed: tests/pr/bounded-memory. tests/pr/bounded-memory is passing on 'main'. Maybe you have to rebase?
GNU test failed: tests/rm/isatty. tests/rm/isatty is passing on 'main'. Maybe you have to rebase?
Congrats! The gnu test tests/mv/meta-to-xpart is no longer failing!
Note: The gnu test tests/printf/printf-surprise is now being skipped but was previously passing.
Congrats! The gnu test tests/expand/bounded-memory is now passing!

github-actions · 2026-02-14T12:09:18Z

GNU testsuite comparison:

GNU test failed: tests/cp/parent-perm-race. tests/cp/parent-perm-race is passing on 'main'. Maybe you have to rebase?
GNU test failed: tests/factor/t10. tests/factor/t10 is passing on 'main'. Maybe you have to rebase?
GNU test failed: tests/timeout/timeout-group. tests/timeout/timeout-group is passing on 'main'. Maybe you have to rebase?
Congrats! The gnu test tests/factor/t29 is no longer failing!
Congrats! The gnu test tests/mv/meta-to-xpart is no longer failing!
Congrats! The gnu test tests/pr/bounded-memory is no longer failing!
Note: The gnu test tests/dd/no-allocate is now being skipped but was previously passing.
Congrats! The gnu test tests/cut/cut-huge-range is now passing!
Congrats! The gnu test tests/rm/many-dir-entries-vs-OOM is now passing!

github-actions · 2026-02-18T10:23:51Z

GNU testsuite comparison:

GNU test failed: tests/date/date-locale-hour. tests/date/date-locale-hour is passing on 'main'. Maybe you have to rebase?
Congrats! The gnu test tests/cut/bounded-memory is no longer failing!
Congrats! The gnu test tests/mv/meta-to-xpart is no longer failing!
Note: The gnu test tests/basenc/bounded-memory is now being skipped but was previously passing.
Note: The gnu test tests/cp/link-heap is now being skipped but was previously passing.
Note: The gnu test tests/dd/no-allocate is now being skipped but was previously passing.

Reordered import statements in test_df.rs and test_mv.rs to follow a consistent pattern, moving conditional imports and utility functions to their proper positions within the import blocks. This improves code readability and maintains consistency across test files.

sylvestre · 2026-03-16T21:42:12Z

@mattsu2020 some lint issues, sorry!

- Use entry.file_type() for efficient type checking (mv_fix approach) - Use copy_file_with_hardlinks_helper on Unix for hardlink support (main approach) - Use rename_symlink_fallback on non-Unix (main approach) - Symlinks handled before regular files, no need for second symlink check

github-actions · 2026-03-24T10:39:58Z

GNU testsuite comparison:

Skipping an intermittent issue tests/cut/bounded-memory (passes in this run but fails in the 'main' branch)
Skipping an intermittent issue tests/date/date-locale-hour (passes in this run but fails in the 'main' branch)
Congrats! The gnu test tests/mv/meta-to-xpart is no longer failing!
Note: The gnu test tests/seq/seq-epipe is now being skipped but was previously passing.

oech3 mentioned this pull request Dec 19, 2025

mv loses ownership on cross-device moves #9714

Closed

This comment was marked as resolved.

Sign in to view

oech3 mentioned this pull request Dec 24, 2025

Move all test depending on root to GNU's test suite #9492

Closed

oech3 reviewed Jan 1, 2026

View reviewed changes

sylvestre reviewed Jan 17, 2026

View reviewed changes

mattsu2020 force-pushed the mv_fix branch from 6f3e6a3 to eadf572 Compare January 19, 2026 11:56

sylvestre force-pushed the mv_fix branch from eadf572 to cd1147d Compare February 10, 2026 20:37

sylvestre reviewed Feb 10, 2026

View reviewed changes

Comment thread src/uu/mv/src/mv.rs

sylvestre reviewed Feb 10, 2026

View reviewed changes

Comment thread src/uu/mv/src/mv.rs Outdated

mattsu2020 force-pushed the mv_fix branch from 0d0453d to a3b4272 Compare February 14, 2026 11:22

mattsu2020 force-pushed the mv_fix branch from 5642e78 to 7cdb42b Compare February 18, 2026 10:08

mattsu2020 added 3 commits March 5, 2026 00:03

feat(mv): preserve metadata and symlink behavior in fallback moves

8bd5604

test(uutests): extract rootless unshare helpers

1adfe14

test(mv): add cross-device ownership and dangling symlink coverage

38ab84c

sylvestre force-pushed the mv_fix branch from 281de06 to ddb29f0 Compare March 4, 2026 23:03

mattsu2020 and others added 2 commits March 20, 2026 19:52

Merge branch 'main' into mv_fix

7058753

Uh oh!

Uh oh!

Conversation

mattsu2020 commented Dec 16, 2025

Summary

Background / Problem

Changes

Testing

Uh oh!

github-actions Bot commented Dec 16, 2025

Uh oh!

This comment was marked as resolved.

oech3 Jan 1, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Jan 12, 2026

Uh oh!

sylvestre Jan 17, 2026

Choose a reason for hiding this comment

Uh oh!

sylvestre Jan 17, 2026

Choose a reason for hiding this comment

Uh oh!

sylvestre Jan 17, 2026

Choose a reason for hiding this comment

Uh oh!

sylvestre Jan 17, 2026

Choose a reason for hiding this comment

Uh oh!

codspeed-hq Bot commented Jan 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merging this PR will not alter performance

Footnotes

Uh oh!

github-actions Bot commented Jan 19, 2026

Uh oh!

Uh oh!

sylvestre Feb 10, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

github-actions Bot commented Feb 10, 2026

Uh oh!

github-actions Bot commented Feb 11, 2026

Uh oh!

ChrisDryden commented Feb 12, 2026

Uh oh!

sylvestre commented Feb 12, 2026

Uh oh!

mattsu2020 commented Feb 14, 2026

Uh oh!

github-actions Bot commented Feb 14, 2026

Uh oh!

github-actions Bot commented Feb 14, 2026

Uh oh!

github-actions Bot commented Feb 18, 2026

Uh oh!

sylvestre commented Mar 16, 2026

Uh oh!

github-actions Bot commented Mar 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

codspeed-hq Bot commented Jan 19, 2026 •

edited

Loading