mv:fix file ownership changes when a file is mv'ed by root to a different file system by mattsu2020 · Pull Request #9672 · uutils/coreutils

mattsu2020 · 2025-12-16T09:47:54Z

Summary

Fix cross-filesystem mv (EXDEV copy+delete fallback) so that file ownership does not change to the invoking user (e.g. root) when moving a file across filesystems.

Fixes #9635.

Background / Problem

When mv cannot rename(2) across devices (EXDEV), uutils falls back to copy+delete. The copy path used std::fs::copy, which creates the destination owned by the caller. If root moves a file owned by another user to a different filesystem, the destination ends up owned by root (compatibility + security concern).

Changes

On Unix, preserve uid/gid and mode after the copy step in the EXDEV fallback:
- regular files (including the hardlink-aware copy path)
- directories (including recursively created subdirectories)
- symlinks (use lchown, do not follow)
- FIFOs
Restore mode after chown to keep correct permission bits (since chown may clear setuid/setgid).
Add a Linux-only regression test that runs only as root and verifies uid/gid are preserved across partitions (/dev/shm tmpfs).
Address clippy (bind_instead_of_map) in the copy path.

Testing

cargo test -p uu_mv
cargo clippy -p uu_mv -- -D warnings

related
#9635

github-actions · 2025-12-16T10:03:41Z

GNU testsuite comparison:

Skipping an intermittent issue tests/tail/overlay-headers (passes in this run but fails in the 'main' branch)

oech3 · 2026-01-01T12:02:12Z

tests/by-util/test_mv.rs

+        .env("BASE", &base)
+        .env("UUTILS", &scene.bin_path)
+        .output()
+        .expect("failed to run unshare");


It might better to create a new function for uhshare (at different PR).
Ref: #9973

github-actions · 2026-01-12T01:01:37Z

GNU testsuite comparison:

Skipping an intermittent issue tests/timeout/timeout (passes in this run but fails in the 'main' branch)

sylvestre · 2026-01-17T15:29:09Z

src/uu/mv/src/mv.rs

 }

+#[cfg(unix)]
+fn try_preserve_ownership(from_meta: &fs::Metadata, to: &Path, follow_symlinks: bool) {


document this function please

sylvestre · 2026-01-17T15:29:25Z

src/uu/mv/src/mv.rs

+
+    unsafe {
+        if follow_symlinks {
+            let _ = libc::chown(to_cstr.as_ptr(), uid, gid);


please manage the errors

sylvestre · 2026-01-17T15:29:38Z

src/uu/mv/src/mv.rs

+}
+
+#[cfg(unix)]
+fn try_preserve_permissions(from_meta: &fs::Metadata, to: &Path) {


same, please document it

sylvestre · 2026-01-17T15:29:45Z

src/uu/mv/src/mv.rs

+
+    // Keep mode bits only (file type bits are not allowed in chmod).
+    let mode = from_meta.mode() & 0o7777;
+    let _ = fs::set_permissions(to, fs::Permissions::from_mode(mode));


please manage the error

codspeed-hq · 2026-01-19T12:40:13Z

Merging this PR will not alter performance

✅ 284 untouched benchmarks
⏩ 38 skipped benchmarks¹

_{Comparing mattsu2020:mv_fix (c911eb8) with main (54566dd)}

38 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

github-actions · 2026-01-19T12:58:24Z

GNU testsuite comparison:

Skip an intermittent issue tests/tty/tty-eof (fails in this run but passes in the 'main' branch)

src/uu/mv/src/mv.rs

sylvestre · 2026-02-10T20:43:09Z

src/uu/mv/src/mv.rs

+fn copy_symlink(from: &Path, to: &Path) -> io::Result<()> {
+    let from_meta = from.symlink_metadata()?;
+    let path_symlink_points_to = fs::read_link(from)?;
+    unix::fs::symlink(path_symlink_points_to, to).map(|_| {


it should copy xattrs like rename_symlink_fallback does. no ?

src/uu/mv/src/mv.rs

github-actions · 2026-02-10T20:46:37Z

GNU testsuite comparison:

Congrats! The gnu test tests/mv/meta-to-xpart is no longer failing!

github-actions · 2026-02-11T12:17:24Z

GNU testsuite comparison:

GNU test failed: tests/timeout/timeout-group. tests/timeout/timeout-group is passing on 'main'. Maybe you have to rebase?
Congrats! The gnu test tests/mv/meta-to-xpart is no longer failing!

ChrisDryden · 2026-02-12T19:06:03Z

I think we have a chmod helper that we can use here that implements all of the logic in the PR already in the uucore perms lib

sylvestre · 2026-02-12T19:44:22Z

and it conflicts

mattsu2020 · 2026-02-14T07:09:10Z

I think we have a chmod helper that we can use here that implements all of the logic in the PR already in the uucore perms lib

wrap_chown is too high-level for mv compatibility logic. It returns formatted Result<String, String>, so mv cannot inspect errno to implement GNU-like behavior (owner+group attempt, optional group-only fallback, and selective suppression for EPERM/EACCES/EINVAL).

To avoid behavior regressions, I’d like to add a public low-level helper in uucore::perms that returns io::Result<()> (preserving errno), then switch mv to that helper while keeping GNU-compatible branching in mv. This still removes syscall duplication, but without changing user-visible behavior.

… Unix Add functions to preserve file ownership (UID/GID) and permissions (mode) during mv operations when fs::rename fails and falls back to copy+remove. This ensures consistency with GNU mv behavior across filesystems, applying preservation in rename fallbacks for files, directories, symlinks, FIFOs, and recursive copies. Changes are Unix-specific, using libc::chown/lchown and fs::set_permissions.

Add a new Linux-only test to verify cross-device move behavior using user namespaces and tmpfs mounts, avoiding sudo. This mirrors GNU's part-fail scenario for directories containing dangling symlinks, ensuring the mv command preserves symlinks correctly in rootless environments.

- Modified HardlinkGroupScanner to skip symlinks using symlink_metadata, as hardlink preservation does not apply to them - Added copy_symlink functions for Unix, Windows, and other platforms to copy symlinks without dereferencing - Updated copy_dir_contents_recursive to detect and copy symlinks, including verbose output, preventing dereferencing during directory moves

Updated the copy_symlink function to use .map() combinator instead of .and_then() for clarity, as the closure performs a side effect (preserving ownership) and returns a unit value without chaining Results. This improves code readability and appropriateness of the combinator used.

Simplify the map closure by removing the explicit return of an empty tuple, as it is implicit in Rust when no value is needed. This improves code clarity without affecting functionality.

…ervation - Capture return values from chown/lchown and set_permissions calls - Emit warnings for non-permission errors to inform users of preservation failures - Keep operations non-fatal as preservation is best-effort on Unix systems

Co-authored-by: Sylvestre Ledru <sylvestre@debian.org>

Replace the duplicated symlink handling logic in rename_symlink_fallback functions across Unix, Windows, and other platforms with a call to the existing copy_symlink function. This reduces code duplication and centralizes symlink copying logic while maintaining the same functionality of copying the symlink and then removing the original file.

github-actions · 2026-02-14T11:33:12Z

GNU testsuite comparison:

GNU test failed: tests/pr/bounded-memory. tests/pr/bounded-memory is passing on 'main'. Maybe you have to rebase?
GNU test failed: tests/rm/isatty. tests/rm/isatty is passing on 'main'. Maybe you have to rebase?
Congrats! The gnu test tests/mv/meta-to-xpart is no longer failing!
Note: The gnu test tests/printf/printf-surprise is now being skipped but was previously passing.
Congrats! The gnu test tests/expand/bounded-memory is now passing!

Add a check to skip the inter_partition_copying test when source and destination directories are on the same filesystem, preventing false test failures when /dev/shm is not available or mounted on the same device as the source.

github-actions · 2026-02-14T12:09:18Z

GNU testsuite comparison:

GNU test failed: tests/cp/parent-perm-race. tests/cp/parent-perm-race is passing on 'main'. Maybe you have to rebase?
GNU test failed: tests/factor/t10. tests/factor/t10 is passing on 'main'. Maybe you have to rebase?
GNU test failed: tests/timeout/timeout-group. tests/timeout/timeout-group is passing on 'main'. Maybe you have to rebase?
Congrats! The gnu test tests/factor/t29 is no longer failing!
Congrats! The gnu test tests/mv/meta-to-xpart is no longer failing!
Congrats! The gnu test tests/pr/bounded-memory is no longer failing!
Note: The gnu test tests/dd/no-allocate is now being skipped but was previously passing.
Congrats! The gnu test tests/cut/cut-huge-range is now passing!
Congrats! The gnu test tests/rm/many-dir-entries-vs-OOM is now passing!

oech3 mentioned this pull request Dec 19, 2025

mv loses ownership on cross-device moves #9714

Open

This comment was marked as resolved.

Sign in to view

oech3 mentioned this pull request Dec 24, 2025

Move all test depending on root to GNU's test suite #9492

Closed

oech3 reviewed Jan 1, 2026

View reviewed changes

sylvestre reviewed Jan 17, 2026

View reviewed changes

mattsu2020 force-pushed the mv_fix branch from 6f3e6a3 to eadf572 Compare January 19, 2026 11:56

sylvestre force-pushed the mv_fix branch from eadf572 to cd1147d Compare February 10, 2026 20:37

sylvestre reviewed Feb 10, 2026

View reviewed changes

src/uu/mv/src/mv.rs Show resolved Hide resolved

sylvestre reviewed Feb 10, 2026

View reviewed changes

src/uu/mv/src/mv.rs Outdated Show resolved Hide resolved

mattsu2020 and others added 8 commits February 14, 2026 20:21

refactor(mv): remove unnecessary unit return in copy_symlink

b2589cc

Simplify the map closure by removing the explicit return of an empty tuple, as it is implicit in Rust when no value is needed. This improves code clarity without affecting functionality.

Update src/uu/mv/src/mv.rs

fc32a78

Co-authored-by: Sylvestre Ledru <sylvestre@debian.org>

mattsu2020 force-pushed the mv_fix branch from 0d0453d to a3b4272 Compare February 14, 2026 11:22

fix: Add filesystem check to inter_partition copying test

c911eb8

Add a check to skip the inter_partition_copying test when source and destination directories are on the same filesystem, preventing false test failures when /dev/shm is not available or mounted on the same device as the source.

Uh oh!

Conversation

mattsu2020 commented Dec 16, 2025

Summary

Background / Problem

Changes

Testing

Uh oh!

github-actions bot commented Dec 16, 2025

Uh oh!

This comment was marked as resolved.

oech3 Jan 1, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Jan 12, 2026

Uh oh!

sylvestre Jan 17, 2026

Choose a reason for hiding this comment

Uh oh!

sylvestre Jan 17, 2026

Choose a reason for hiding this comment

Uh oh!

sylvestre Jan 17, 2026

Choose a reason for hiding this comment

Uh oh!

sylvestre Jan 17, 2026

Choose a reason for hiding this comment

Uh oh!

codspeed-hq bot commented Jan 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merging this PR will not alter performance

Footnotes

Uh oh!

github-actions bot commented Jan 19, 2026

Uh oh!

Uh oh!

sylvestre Feb 10, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

github-actions bot commented Feb 10, 2026

Uh oh!

github-actions bot commented Feb 11, 2026

Uh oh!

ChrisDryden commented Feb 12, 2026

Uh oh!

sylvestre commented Feb 12, 2026

Uh oh!

mattsu2020 commented Feb 14, 2026

Uh oh!

github-actions bot commented Feb 14, 2026

Uh oh!

github-actions bot commented Feb 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

codspeed-hq bot commented Jan 19, 2026 •

edited

Loading