I don't know about the API but as far as I understand the man page, there doesn't appear to be a way to delete a subvolume on the remote side by doing btrfs receive.
That btrfs receive may well be exploitable (because of some bug) if you feed it with malicious data is IMO a different topic.
while it doesn't allow you to delete a subvolume (i.e. what a snapshot is built off of), it does seem like one could conceptually just overwrite it via send/recieve? perhaps its a bit smarter and doesn't let snapshots be modified, but I'm now a bit unconvinced that it can be viewed as simply an "append only" interface.
> ... it does seem like one could conceptually just overwrite it via send/recieve?
Don't think so.
The man page for btrfs receive states:
> btrfs receive will fail in the following cases:
> 1. receiving subvolume already exists
I also just tried it out. I created some subvol1-ro in a source filesystem, then sent it to the destination filesystem. Then deleted the source subvol1-ro. Then created a new subvol1-ro containing a different file and tried to send it to the same destination.
so, if I use a subvolume (not as a snapshot, but as something I can modify) I can't use send/receive on it? it seems a little weird. I'd assume I should be able to send modifications to the remote end (and my argument is, if one can send modifications, one should be able to send modifications that effectively delete all content). I temper this argument that even if true, perhaps subvolumes marked as snapshots one cannot do this to.
AFAIK only read only snapshots can be sent and received. It kind of makes sense, since a writable snapshot could be written to during the send/receive so that the remote result would not match any clearly defined local state.
A received ro snapshot can be used as a base for a new writable snapshot.
ok, you are probably right, glanced at send.h and it seems it only allows a limited set of "btrfs" fs operations.
that would fit with my description (at least in a sense) it enables an "append" only mode to a remote side (where "append" means cant mess with previous snapshots remotely).
That btrfs receive may well be exploitable (because of some bug) if you feed it with malicious data is IMO a different topic.