Re: [PATCH v2 1/2] btrfs-progs: warn users about the possible dangers of check --repair

[David Sterba <dsterba@suse.cz>]

On Tue, Oct 22, 2019 at 09:33:06AM +0200, Johannes Thumshirn wrote:
> On 21/10/2019 17:22, David Sterba wrote:
> > --force was added for a different reason, to allow check on a mounted
> > filesystem. I don't think that combining --repair and --force just to
> > allow repair is a good idea. There's a 'dangerous repair' mode for eg.
> > xfs that allows to do live surgery on a mounted filesytem (followed by
> > immediate reboot). We want to be able to do that eventually.
> > 
> > I understand where the motivation comes from, let me have a second
> > thought on that.
> 
> So how about adding a '--yes' or '--accept', '--dangerous',
> '--allow-dangeruos' parameter instead of force to skip the warning?
> 
> My vote would go for '--allow-dangerous'.

So, I agree with the above. The dangerous repair should be something
almost nobody does or should do, so a very long option name is just
fine. This leaves -f for --repair to skip the warning. We now have:

* btrfs check - read-only by default, no changes

* btrfs check --read-only - same as above, explicit about RO

* btrfs check --repair - warning with a timeout, then repair

* btrfs check --repair -f - no warning (or the warning could be still
                            printed but without timeout)

I'd rather avoid options that would be confusing to what are they
referring to. So '--yes' it's like don't ask questions before repairing,
that's what e2fsck does but that's different from the initial warning.
And so on.

The dangerous repair would need a full set of the options, so

* btrfs --repair -f --allow-dangerous