branches: 1.9.112;
Remove WARNS=1 from all the subdirectory Makefiles, and add it to Makefile.inc
now that all /bin has been cleaned.

Fix compiler warnings.
Add WARNS=1

convert to new RCS id conventions.

Merge with 4.4-Lite version.

don't need -lutil

Add RCS identifiers.

changed "Id" to "Header" for rcsids

added rcs ids to all files

branches: 1.1.1;
Initial revision

branches: 1.29.6;
Remove workaround for ancient HTML generation code.

Document the version rm first appeared.
Bump date.

Sort sections.

PR/47770: Eitan Adler: add x flag to rm to avoid cross mount points

Remove a few unneeded Pp macros.

branches: 1.24.40; 1.24.46;
New sentence, new line. Bump date for previous.

Document new -P behaviour

Sort sections, bump date for previous, and add a comma after e.g..

Add an EXAMPLES section to answer PR 22255

Bump date for previous; |fmt; remove trailing white space.
New sentence, new line.

UFS->FFS

Change behaviour of -P option to conform generally to DoD 5220.22-M
standard. This change inspired by Apple's "Secure Empty Trash" functionality
in MacOS 10.3. However, it is important to understand that this change
does not -- and can not -- actually achieve conformance to the current
revision of the standard. To quote the manual page:

The -P option attempts to conform to U.S. DoD 5220-22.M, "National Indus-
trial Security Program Operating Manual" ("NISPOM") as updated by Change
2 and the July 23, 2003 "Clearing & Sanitization Matrix". However,
unlike earlier revisions of NISPOM, the 2003 matrix imposes requirements
which make it clear that the standard does not and can not apply to the
erasure of individual files, in particular requirements relating to spare
sector management for an entire magnetic disk. Because these
requirements are not met, the -P option does not conform to the standard.

This also makes the -P option a *lot* more expensive than it used to be.
It used to overwrite with 0xff, overwrite with 0x00, overwrite with 0xff,
with an fsync after each write. Now it overwrites with a random character,
overwrites with 0xff, overwrites with 0x00, reads to validate the 0x00
overwrite, then overwrites with random data -- calling sync() after every
operation in an attempt to force seeks that will clear the data from the
cache of disks that lie about whether data has been committed to the
platters. Also, the file's opened with O_SYNC|O_RSYNC to cause metadata
updates on every read/write, which should cause still more seeks.

This is better than it used to be, but it's by no means adequate if you
have data you really don't want read by an adversary who can pull the
disk apart.

Move UCB-licensed code from 4-clause to 3-clause licence.

Patches provided by Joel Baker in PR 22249, verified by myself.

New sentence, new line. I'm having a slight deja-vu...

Added the -v flag.

A default .Ar arugment is sufficient.

Generate <>& symbolically. I'm avoiding .../dist/... directories for now.

Whitespace nits.

For commands and utilities, use EXIT STATUS rather than RETURN VALUES as
appropriate (and documented in mdoc(7)).

Add 'RETURN VALUE' section header.

branches: 1.9.12;
Fix .Nm usage.

Use "utility" instead of "command". Modern definitions of these terms
are distinct (See POSIX.2 glossary).

A utility is a executable, script or shell builtin; while a command
can be any of those things plus lists, pipelines, compound commands
(if, for, while) and shell function definitions.

convert to new RCS id conventions.

Mostly sync with CSRG.

Merge with 4.4-Lite version.

Add RCS indentifiers.

changed "Id" to "Header" for rcsids

added rcs ids to all files

branches: 1.1.1;
Initial revision

Remove unnecessary initialization to zero of static int option flags

This results in uniform handling of all of them, instead of some being
explicitly initialized and some not. Reduces confusion in the reader.

branches: 1.54.4;
bin: remove unnecessary lint comment CONSTCOND

Since 2021-01-31, lint no longer warns about 'do ... while (0)'.

No functional change.

branches: 1.53.30;
PR/47770: Eitan Adler: add x flag to rm to avoid cross mount points

branches: 1.52.2;
Rectify race condition in rm -P processing by checking that the file
we opened is the one we expected to get. Also use O_NOFOLLOW to help
avoid even opening devices, which sometimes produce side effects.

Reported by Radoslaw A. Zarzynski.

branches: 1.51.2;
Siginfo support from Daniel Loffgren

branches: 1.50.2;
static + __dead

fix -Wsign-compare issues

branches: 1.48.4; 1.48.6;
Remove the \n and tabs from the __COPYRIGHT() strings.

PR/38754: murray armfield: Rm prints diagnostic messages when invoked with -f
and no other arguments, contrary to POSIX. Also cosmetic fixes.

branches: 1.46.10; 1.46.12;
PR/36535: Greg A. Woods: rm(1) should present user:group the same way as
chown(8) et al

branches: 1.45.2;
Only remove the file if the file can be successfully
overwritten. Old code would remove the file regardless of
whether the overwrite was successful or not.

New behaviour:

carpy: {12} touch moo ; chmod 444 moo
carpy: {13} ls
moo
carpy: {14} rm -P moo
rm: moo: -P was specified but file could not be overwritten
carpy: {15} ls
moo
carpy: {16}

ok: christos@, joerg@ & tech-userlevel@

Fix sentence fragment that somehow got into the long comment about rm -P.

Call fts_close() at the end of rm_tree().

Fixes Coverity CID 1670.

Fix typo.

Adjust comment to indicate what this code is actually useful for, and that
it's not really "cheap".

Change behaviour of -P option to conform generally to DoD 5220.22-M
standard. This change inspired by Apple's "Secure Empty Trash" functionality
in MacOS 10.3. However, it is important to understand that this change
does not -- and can not -- actually achieve conformance to the current
revision of the standard. To quote the manual page:

The -P option attempts to conform to U.S. DoD 5220-22.M, "National Indus-
trial Security Program Operating Manual" ("NISPOM") as updated by Change
2 and the July 23, 2003 "Clearing & Sanitization Matrix". However,
unlike earlier revisions of NISPOM, the 2003 matrix imposes requirements
which make it clear that the standard does not and can not apply to the
erasure of individual files, in particular requirements relating to spare
sector management for an entire magnetic disk. Because these
requirements are not met, the -P option does not conform to the standard.

This also makes the -P option a *lot* more expensive than it used to be.
It used to overwrite with 0xff, overwrite with 0x00, overwrite with 0xff,
with an fsync after each write. Now it overwrites with a random character,
overwrites with 0xff, overwrites with 0x00, reads to validate the 0x00
overwrite, then overwrites with random data -- calling sync() after every
operation in an attempt to force seeks that will clear the data from the
cache of disks that lie about whether data has been committed to the
platters. Also, the file's opened with O_SYNC|O_RSYNC to cause metadata
updates on every read/write, which should cause still more seeks.

This is better than it used to be, but it's by no means adequate if you
have data you really don't want read by an adversary who can pull the
disk apart.

remove unused code left from printescaped() backput as pointed out by Jeff
Ito in PR bin/23969 and PR bin/23970.

Following private discussion with kleink@ and hubertf@ and public discussion
on tech-userlevel@, back out printescaped() functionality.
kleink: ``We sell rope.''

use bounded string op

Move UCB-licensed code from 4-clause to 3-clause licence.

Patches provided by Joel Baker in PR 22249, verified by myself.

As discusses a little while back on tech-userlevel:

If stdout is a tty, use vis(3) to print any filenames to prevent garbage
from being printed if the filename contains control- or other non-printable
characters.

While here, sprinkle some EXIT_FAILURE and NOTREACHED where appropriate.

Remove space at the end of line.

Note: Original change approved by Enami.
Accidentally left eval = 1 when I was adding the extension which caused the rm command to return a 1 when it successfully removed a directory. Thanks to tron for catching it.

Added the -v flag.

- Remove the last __P.
- Don't put space between function name and () op.

- Use four space to indent continuation line.
- Put a space after the C language keyword ``switch''.
- Put an empty line if a function doesn't have local variable.
- Use do { } while (/*CONSTCOND*/ 0) instead of { } to protect a multi
statement macro

Sync getopt() / man page with actual getopt options.

Patch from mycroft to fix case of rm -rf nonexistant on a r/o fs would still
report errors. Checking the fts_errno for ENOENT before attempting removal
fixes this.

ANSIfy, KNF, [gs]etprogname, by Petri Koistinen.

branches: 1.26.4;
Since our gcc doesn't warn about NULL format strings anymore, we can
fix the incorrect err(1, "%s", "") et al.
Closes PR bin/7592 by cgd.

branches: 1.25.4;
Don't ask for permission to unlink a file if the access error is ETXTBSY.
This needs vfs_syscalls.c 1.138 to really work.
Fixes pr 4134 by Johan Danielsson.

Be more retentive about use of NOTREACHED and noreturn.

Delint.

Delint.

Per 1003.2, no warnings shall be generated for attempts to remove non-existent
files in case the `-f' option has been specified:
Extend the definition of `non-existent' to include ENAMETOOLONG and ENOTDIR
cases, since file names failing with these errors can safely assumed to be
non-existent. Fixes PR bin/2993.

Fix compiler warnings.
Add WARNS=1

Sync with 4.4lite2

convert to new RCS id conventions.

Mostly sync with CSRG.

Strip trailing slashes of operands in checkdot().

POSIX.2 requires that if "." or ".." are specified as the basename
portion of an operand, a diagnostic message be written to standard
error, etc. We strip the slashes because POSIX.2 defines basename
as the final portion of a pathname after trailing slashes have been
removed.

This also makes rm "perform actions equivalent to" the POSIX.1
rmdir() and unlink() functions when removing directories and files,
even when they do not follow POSIX.1's pathname resolution semantics
(which require trailing slashes be ignored).

Merge with 4.4-Lite version.

Fix bug where two messages were printed when a directory could not
be removed due to some error.

The -f flag suppresses error messages and changes to the exit value if
a file specified on the command line does not exist. This is the _only_
case where error messages/exit value are effected by the -f flag.

Change order of conditional so that a possible null pointer is not
dereferenced. This case would only occur when stdin was not a tty.
Thanks to Dan Muntz for discovering this bug.

Some minor fixes:
If all the arguments have a "." or ".." basename, the exit value should be
modified whether or not the -f flag was specified.
Don't exit if a file can not be read or there is another error (FTS_DNR or
FTS_ERR), there are probably other files that we can process successfully.

Check user's response against both 'Y' and 'y' --- this is really supposed
to be a locale specific regular expression. This change hard codes POSIX
locale behavior, and will be replaced by a locale independant equivalent
as soon as locales are fully implemented.

Don't ask about each directory twice when using -r and -i flags.
Exit value is not always zero when using -f flag, only if all files were
removed or non-existant.

Changed conditional from "iflag && check(...)" to "!fflag && check(...)".
Removed the !fflag from conditionals in check() ... the check function
is never executed if !fflag.

Changed so that rm without -r or -R is 1003.2 compliant --- I haven't
had time to look at the recursive code, but it probably has the same
types of problems.
Added code to set the default locale, so it will work correctly when
our locale code is more than just stubs.
Added prototypes, etc. to make gcc -Wall happier.

change for new fts library

Add RCS identifiers.

Be silent if -f specified.

changed "Id" to "Header" for rcsids

added rcs ids to all files

branches: 1.1.1;
Initial revision