[pbs-devel] [PATCH proxmox-backup 05/12] backup/datastore: prevent protected snapshots to be removed

[Fabian Grünbichler]

On September 6, 2021 12:57 pm, Dominik Csapak wrote:
> by throwing an error for remove_backup_dir, and skipping for
> remove_backup_group
> 
> Signed-off-by: Dominik Csapak <d.csapak at proxmox.com>
> ---
>  src/backup/datastore.rs | 37 +++++++++++++++++++++++++------------
>  1 file changed, 25 insertions(+), 12 deletions(-)
> 
> diff --git a/src/backup/datastore.rs b/src/backup/datastore.rs
> index 7986c328..03f0a744 100644
> --- a/src/backup/datastore.rs
> +++ b/src/backup/datastore.rs
> @@ -270,8 +270,9 @@ impl DataStore {
>          full_path
>      }
>  
> -    /// Remove a complete backup group including all snapshots
> -    pub fn remove_backup_group(&self, backup_group: &BackupGroup) ->  Result<(), Error> {
> +    /// Remove a complete backup group including all snapshots, returns true
> +    /// if all snapshots were removed, and false if some were protected
> +    pub fn remove_backup_group(&self, backup_group: &BackupGroup) ->  Result<bool, Error> {
>  
>          let full_path = self.group_path(backup_group);
>  
> @@ -279,22 +280,30 @@ impl DataStore {
>  
>          log::info!("removing backup group {:?}", full_path);
>  
> +        let mut removed_all = true;
> +
>          // remove all individual backup dirs first to ensure nothing is using them
>          for snap in backup_group.list_backups(&self.base_path())? {

could also first iterate and check for protected status, and skip 
removal of any snapshot entirely if we find a protected snapshot?

it would still require the re-check in case the protection status 
changed in the meantime, since that is not guarded by any lock atm, and 
even if it were, it would be a snapshot level lock, and we can't hold 
all of those for the whole group here ;)

alternatively (since the remove group call bails anyway if a protected 
snapshot was skipped), we could bail directly here when encountering the 
first protected snapshot to simplify matters a bit?

> +            if snap.backup_dir.is_protected(self.base_path()) {
> +                removed_all = false;
> +                continue;
> +            }
>              self.remove_backup_dir(&snap.backup_dir, false)?;
>          }
>  
> -        // no snapshots left, we can now safely remove the empty folder
> -        std::fs::remove_dir_all(&full_path)
> -            .map_err(|err| {
> -                format_err!(
> -                    "removing backup group directory {:?} failed - {}",
> -                    full_path,
> -                    err,
> -                )
> -            })?;
> +        if removed_all {
> +            // no snapshots left, we can now safely remove the empty folder
> +            std::fs::remove_dir_all(&full_path)
> +                .map_err(|err| {
> +                    format_err!(
> +                        "removing backup group directory {:?} failed - {}",
> +                        full_path,
> +                        err,
> +                    )
> +                })?;
> +        }
>  
> -        Ok(())
> +        Ok(removed_all)
>      }
>  
>      /// Remove a backup directory including all content
> @@ -308,6 +317,10 @@ impl DataStore {
>              _manifest_guard = self.lock_manifest(backup_dir)?;
>          }
>  
> +        if backup_dir.is_protected(self.base_path()) {
> +            bail!("cannot remove protected snapshot");
> +        }
> +
>          log::info!("removing backup snapshot {:?}", full_path);
>          std::fs::remove_dir_all(&full_path)
>              .map_err(|err| {
> -- 
> 2.30.2
> 
> 
> 
> _______________________________________________
> pbs-devel mailing list
> pbs-devel at lists.proxmox.com
> https://lists.proxmox.com/cgi-bin/mailman/listinfo/pbs-devel
> 
> 
>