From owner-freebsd-bugs  Wed Jun 12 05:10:06 1996
Return-Path: owner-bugs
Received: (from root@localhost)
          by freefall.freebsd.org (8.7.5/8.7.3) id FAA28297
          for bugs-outgoing; Wed, 12 Jun 1996 05:10:06 -0700 (PDT)
Received: (from gnats@localhost)
          by freefall.freebsd.org (8.7.5/8.7.3) id FAA28270;
          Wed, 12 Jun 1996 05:10:04 -0700 (PDT)
Resent-Date: Wed, 12 Jun 1996 05:10:04 -0700 (PDT)
Resent-Message-Id: <199606121210.FAA28270@freefall.freebsd.org>
Resent-From: gnats (GNATS Management)
Resent-To: freebsd-bugs
Resent-Reply-To: FreeBSD-gnats@freefall.FreeBSD.org, zgabor@code.hu
Received: from mail.EUnet.hu (mail.eunet.hu [193.225.28.100])
          by freefall.freebsd.org (8.7.5/8.7.3) with ESMTP id FAA27841
          for <FreeBSD-gnats-submit@freebsd.org>; Wed, 12 Jun 1996 05:01:52 -0700 (PDT)
Received: by mail.EUnet.hu, id OAA10063; Wed, 12 Jun 1996 14:01:38 +0200
Received: from zg.CoDe.hu by CoDe.CoDe.hu (NAA02757); Wed, 12 Jun 1996 13:42:45 GMT
Received: (from zgabor@localhost) by zg.CoDe.hu (8.6.12/8.6.12) id NAA00494; Wed, 12 Jun 1996 13:57:26 +0200
Message-Id: <199606121157.NAA00494@zg.CoDe.hu>
Date: Wed, 12 Jun 1996 13:57:26 +0200
From: Zahemszky Gabor <zgabor@code.hu>
Reply-To: zgabor@code.hu
To: FreeBSD-gnats-submit@freebsd.org
X-Send-Pr-Version: 3.2
Subject: bin/1314: rmdir(1)/rmdir(2)
Sender: owner-bugs@freebsd.org
X-Loop: FreeBSD.org
Precedence: bulk


>Number:         1314
>Category:       bin
>Synopsis:       rmdir(1)/rmdir(2)
>Confidential:   yes
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          open
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Wed Jun 12 05:10:03 PDT 1996
>Last-Modified:
>Originator:     Zahemszky Gabor
>Organization:
>Release:        FreeBSD 2.1.0-RELEASE i386
>Environment:

	2.1.0-Release from Walnut Creek CD

>Description:

	The rmdir(1) command cannot remove a directory with linknumber>2.
	With the link(2) system call, the superuser can make a hard link
	to a directory, and after it, rmdir failes.
	(Opps, from the source, I've found that the rmdir(2) syscall has
	this bug.)

>How-To-Repeat:

	$ cd /tmp
	$ mkdir lo
	$ link lo lolo
	$ rmdir lo
	rmdir: lo: Directory not empty

	/* And the link source: */
#include	<stdlib.h>
#include	<errno.h>

main( argc, argv )
int	argc;
char	*argv[];
{
if ( link( argv[ 1 ], argv[ 2 ] ) < 0 ) {
	perror( "link failed" );
	return( errno );
	}
return( 0 );
}
	/* end */

>Fix:
	
	

>Audit-Trail:
>Unformatted: