Bug 2024430

Created attachment 1842485 [details]
The source file with the offending code.

Created attachment 1842485 [details]
The source file with the offending code.

Description of problem:

Using --downloaddir with system-upgrade will destroy all other data in the provided directory.

dnf system-upgrade download --downloaddir=/home will destroy all home directories on the computer with no warning.  This is unacceptable.


Version-Release number of selected component (if applicable):

$ dnf list dnf\*
Last metadata expiration check: 0:01:10 ago on Wed 17 Nov 2021 09:40:44 PM MST.
Installed Packages
dnf.noarch                                                                  4.9.0-1.fc35                                                   @fedora 
dnf-data.noarch                                                             4.9.0-1.fc35                                                   @fedora 
dnf-plugins-core.noarch                                                     4.0.24-1.fc35                                                  @updates
dnfdaemon.noarch                                                            0.3.20-7.fc35                                                  @fedora 
dnfdaemon-selinux.noarch                                                    0.3.20-7.fc35                                                  @fedora 
dnfdragora.noarch                                                           2.1.0-5.fc35    


How reproducible:

Will do it every time.  See source code.


Steps to Reproduce:
1. dnf system-upgrade download --downloaddir=/home --releasever=35

Actual results:

upgrade goes fine, but home directories are all deleted !


Expected results:

dnf should not delete any user data


Additional info:

git clone https://github.com/rpm-software-management/dnf-plugins-extras.git 

From dnf-plugins-extras/plugins/system_upgrade.py:  (See attachment) 

def clear_dir(path):
    if not os.path.isdir(path):
        return

    for entry in os.listdir(path):
        fullpath = os.path.join(path, entry)
        try:
            if os.path.isdir(fullpath):
                dnf.util.rm_rf(fullpath)

The developer appears to use #rm -rf on the directory provided.  When I used /home as the download directory, it wiped out all the user data in the home directories on my computer !

Furthermore, there is no warning of this behavior to the user on the command line or on the man page.

I lost months of work just because I used --downloaddir=/home