mv:fix file ownership changes when a file is mv'ed by root to a different file system #9672

mattsu2020 · 2025-12-16T09:47:54Z

Summary

Fix cross-filesystem mv (EXDEV copy+delete fallback) so that file ownership does not change to the invoking user (e.g. root) when moving a file across filesystems.

Fixes #9635.

Background / Problem

When mv cannot rename(2) across devices (EXDEV), uutils falls back to copy+delete. The copy path used std::fs::copy, which creates the destination owned by the caller. If root moves a file owned by another user to a different filesystem, the destination ends up owned by root (compatibility + security concern).

Changes

On Unix, preserve uid/gid and mode after the copy step in the EXDEV fallback:
- regular files (including the hardlink-aware copy path)
- directories (including recursively created subdirectories)
- symlinks (use lchown, do not follow)
- FIFOs
Restore mode after chown to keep correct permission bits (since chown may clear setuid/setgid).
Add a Linux-only regression test that runs only as root and verifies uid/gid are preserved across partitions (/dev/shm tmpfs).
Address clippy (bind_instead_of_map) in the copy path.

Testing

cargo test -p uu_mv
cargo clippy -p uu_mv -- -D warnings

related
#9635

github-actions · 2025-12-16T10:03:41Z

GNU testsuite comparison:

Skipping an intermittent issue tests/tail/overlay-headers (passes in this run but fails in the 'main' branch)

oech3 · 2026-01-01T12:02:12Z

tests/by-util/test_mv.rs

+        .env("BASE", &base)
+        .env("UUTILS", &scene.bin_path)
+        .output()
+        .expect("failed to run unshare");


It might better to create a new function for uhshare (at different PR).
Ref: #9973

github-actions · 2026-01-12T01:01:37Z

GNU testsuite comparison:

Skipping an intermittent issue tests/timeout/timeout (passes in this run but fails in the 'main' branch)

sylvestre · 2026-01-17T15:29:09Z

src/uu/mv/src/mv.rs

 }

+#[cfg(unix)]
+fn try_preserve_ownership(from_meta: &fs::Metadata, to: &Path, follow_symlinks: bool) {


document this function please

sylvestre · 2026-01-17T15:29:25Z

src/uu/mv/src/mv.rs

+
+    unsafe {
+        if follow_symlinks {
+            let _ = libc::chown(to_cstr.as_ptr(), uid, gid);


please manage the errors

sylvestre · 2026-01-17T15:29:38Z

src/uu/mv/src/mv.rs

+}
+
+#[cfg(unix)]
+fn try_preserve_permissions(from_meta: &fs::Metadata, to: &Path) {


same, please document it

sylvestre · 2026-01-17T15:29:45Z

src/uu/mv/src/mv.rs

+
+    // Keep mode bits only (file type bits are not allowed in chmod).
+    let mode = from_meta.mode() & 0o7777;
+    let _ = fs::set_permissions(to, fs::Permissions::from_mode(mode));


please manage the error

codspeed-hq · 2026-01-19T12:40:13Z

Merging this PR will not alter performance

✅ 284 untouched benchmarks
⏩ 38 skipped benchmarks¹

_{Comparing mattsu2020:mv_fix (0d0453d) with main (ec7e81e)}

38 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

github-actions · 2026-01-19T12:58:24Z

GNU testsuite comparison:

Skip an intermittent issue tests/tty/tty-eof (fails in this run but passes in the 'main' branch)

… Unix Add functions to preserve file ownership (UID/GID) and permissions (mode) during mv operations when fs::rename fails and falls back to copy+remove. This ensures consistency with GNU mv behavior across filesystems, applying preservation in rename fallbacks for files, directories, symlinks, FIFOs, and recursive copies. Changes are Unix-specific, using libc::chown/lchown and fs::set_permissions.

Add a new Linux-only test to verify cross-device move behavior using user namespaces and tmpfs mounts, avoiding sudo. This mirrors GNU's part-fail scenario for directories containing dangling symlinks, ensuring the mv command preserves symlinks correctly in rootless environments.

- Modified HardlinkGroupScanner to skip symlinks using symlink_metadata, as hardlink preservation does not apply to them - Added copy_symlink functions for Unix, Windows, and other platforms to copy symlinks without dereferencing - Updated copy_dir_contents_recursive to detect and copy symlinks, including verbose output, preventing dereferencing during directory moves

Updated the copy_symlink function to use .map() combinator instead of .and_then() for clarity, as the closure performs a side effect (preserving ownership) and returns a unit value without chaining Results. This improves code readability and appropriateness of the combinator used.

Simplify the map closure by removing the explicit return of an empty tuple, as it is implicit in Rust when no value is needed. This improves code clarity without affecting functionality.

…ervation - Capture return values from chown/lchown and set_permissions calls - Emit warnings for non-permission errors to inform users of preservation failures - Keep operations non-fatal as preservation is best-effort on Unix systems

sylvestre · 2026-02-10T20:42:38Z

src/uu/mv/src/mv.rs

+/// Copy the given symlink to the given destination without dereferencing.
+/// On Windows, dangling symlinks return an error.
+#[cfg(unix)]
+fn copy_symlink(from: &Path, to: &Path) -> io::Result<()> {


duplicates logic from rename_symlink_fallback(). Refactor rename_symlink_fallback to call copy_symlink() + fs::remove_file()

sylvestre · 2026-02-10T20:43:09Z

src/uu/mv/src/mv.rs

+fn copy_symlink(from: &Path, to: &Path) -> io::Result<()> {
+    let from_meta = from.symlink_metadata()?;
+    let path_symlink_points_to = fs::read_link(from)?;
+    unix::fs::symlink(path_symlink_points_to, to).map(|_| {


it should copy xattrs like rename_symlink_fallback does. no ?

src/uu/mv/src/mv.rs

github-actions · 2026-02-10T20:46:37Z

GNU testsuite comparison:

Congrats! The gnu test tests/mv/meta-to-xpart is no longer failing!

Co-authored-by: Sylvestre Ledru <sylvestre@debian.org>

Replace the duplicated symlink handling logic in rename_symlink_fallback functions across Unix, Windows, and other platforms with a call to the existing copy_symlink function. This reduces code duplication and centralizes symlink copying logic while maintaining the same functionality of copying the symlink and then removing the original file.

github-actions · 2026-02-11T12:17:24Z

GNU testsuite comparison:

GNU test failed: tests/timeout/timeout-group. tests/timeout/timeout-group is passing on 'main'. Maybe you have to rebase?
Congrats! The gnu test tests/mv/meta-to-xpart is no longer failing!

oech3 mentioned this pull request Dec 19, 2025

mv loses ownership on cross-device moves #9714

Open

This comment was marked as resolved.

Sign in to view

oech3 mentioned this pull request Dec 24, 2025

Move all test depending on root to GNU's test suite #9492

Closed

oech3 reviewed Jan 1, 2026

View reviewed changes

sylvestre reviewed Jan 17, 2026

View reviewed changes

mattsu2020 force-pushed the mv_fix branch from 6f3e6a3 to eadf572 Compare January 19, 2026 11:56

mattsu2020 added 6 commits February 10, 2026 21:37

refactor(mv): remove unnecessary unit return in copy_symlink

e747495

Simplify the map closure by removing the explicit return of an empty tuple, as it is implicit in Rust when no value is needed. This improves code clarity without affecting functionality.

sylvestre force-pushed the mv_fix branch from eadf572 to cd1147d Compare February 10, 2026 20:37

sylvestre reviewed Feb 10, 2026

View reviewed changes

src/uu/mv/src/mv.rs Outdated Show resolved Hide resolved

mattsu2020 and others added 2 commits February 11, 2026 14:06

Update src/uu/mv/src/mv.rs

44b0e17

Co-authored-by: Sylvestre Ledru <sylvestre@debian.org>

Uh oh!

mv:fix file ownership changes when a file is mv'ed by root to a different file system #9672

Are you sure you want to change the base?

mv:fix file ownership changes when a file is mv'ed by root to a different file system #9672

Conversation

mattsu2020 commented Dec 16, 2025

Summary

Background / Problem

Changes

Testing

Uh oh!

github-actions bot commented Dec 16, 2025

Uh oh!

This comment was marked as resolved.

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Jan 12, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

codspeed-hq bot commented Jan 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merging this PR will not alter performance

Footnotes

Uh oh!

github-actions bot commented Jan 19, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

github-actions bot commented Feb 10, 2026

Uh oh!

github-actions bot commented Feb 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

codspeed-hq bot commented Jan 19, 2026 •

edited

Loading