Thanks a lot for the clarification! I hadn't quite puzzled this together in my head. It's really counterintuitive that creating a hardlink is allowed based so

Thanks a lot for the clarification! I hadn't quite puzzled this together in my head. It's really counterintuitive that creating a hardlink is allowed based solely on the permissions of the directory it is created in. I think I was expecting another permission check based on the directory the file is sitting in, since that's gating unlink() and rename(). It also means that, any file you can "see", if you have write access somewhere on the same filesystem you can prevent it from being deleted[¹] — even if you can't read it. That feels like a possible privacy issue… [¹] If the user trying to delete file is aware of the problem, they can truncate it to 0 bytes, but that's not what a plain rm does (because rm is also the tool to remove hardlinks…)