rm command possible issue

[Eddie]

Hi,

I noticed something rather interesting (to me anyhow) with the rm 
command. I was able to remove a file whos owner and group was root and 
the permissions on the file were 0400 from within my home directory. See 
below:

address@hidden:~/rmtest$ ls -ld
drwxr-xr-x  2 eddie eddie 4096 2006-05-13 14:15 .
address@hidden:~/rmtest$ su
Password:
rockcrusher:/home/eddie/rmtest# whoami
root
rockcrusher:/home/eddie/rmtest# touch testing
rockcrusher:/home/eddie/rmtest# chmod 0400 testing
rockcrusher:/home/eddie/rmtest# ls -l
total 8.0K
drwxr-xr-x   2 eddie eddie 4.0K 2006-05-13 14:16 .
drwx------  27 eddie eddie 4.0K 2006-05-13 14:15 ..
-r--------   1 root  root     0 2006-05-13 14:16 testing
rockcrusher:/home/eddie/rmtest# exit
address@hidden:~/rmtest$ whoami
eddie
address@hidden:~/rmtest$ ls -l
total 0
-r--------  1 root root 0 2006-05-13 14:16 testing
address@hidden:~/rmtest$ rm testing
rm: remove write-protected regular empty file `testing'? y
address@hidden:~/rmtest$ ls -l
total 0
address@hidden:~/rmtest$

This system is a Debian Linux 3.1 (stable) edition which is using rm 
(coreutils) 5.2.1. My friend tested this on his Debian install and on a 
Gentoo install and the same thing happened.

This may not be a bug, but certainly doesn't make sense to me. I've 
always thought and understood that if the file is owned by root and the 
permissions are 0400 then the file should not be able to be deleted 
regardless of where it is located and/or who the user is unless the user 
is root.

I tried creating a directory with root as user and group then tried to 
remove it but I wasn't allowed to (which is what's suppose to happen). 
So, I've come to the conclusion that it's using the permissions of the 
parent directory to determine if the user can delete the file or not. 
See sample below:

address@hidden:~/rmtest$ ls -l
total 4
drwxr-xr-x  2 root root 4096 2006-05-13 14:24 test
address@hidden:~/rmtest$ rm -r test
rm: descend into write-protected directory `test'? y
rm: remove write-protected regular empty file `test/testing'? y
rm: cannot remove `test/testing': Permission denied
address@hidden:~/rmtest$ cd test
address@hidden:~/rmtest/test$ ls -l
total 0
-r--------  1 root root 0 2006-05-13 14:23 testing
address@hidden:~/rmtest/test$ rm testing
rm: remove write-protected regular empty file `testing'? y
rm: cannot remove `testing': Permission denied
address@hidden:~/rmtest/test$


Regards,
Eddie