Super User 
This week at Super User, MaxMackie asked “How far will you get with a ‘rm -rf /'” ? Within minutes of the post, it had not only my attention, but others as well. It had 39 upvotes just eight short hours later, and answers and thoughts poured in.
I’ve often wondered how far the system will actually get if you run rm -rf /. I doubt the OS would be able to erase itself (?)
We’ve all heard the stories – and please, don’t try this at home! rm -rf has caused a LOT of problems with accidental usage in the past. It is a linux/unix command which erases all files recursively, and won’t stop to ask if you’re sure. Adding the extra / has it start at the root directory – meaning you’re erasing the whole system! But if we did run this on the entire system, how far would the trail of destruction go? I took it upon myself to find out. I fired up VirtualBox, and installed a new copy of Fedora 15 (XFCE). Within minutes I had a fresh install all set and ready to destroy.
Fedora runs very nicely in VM’s, for anyone looking for a nice distro to use. One thought immediately came to mind – will it not remove everything if Xfce is running? I didn’t want to take the risk, and restarted the system in run level 3. I did this with grub, and edited /boot/grub/grub.conf
title Fedora (2.6.38.7-30.fc15.i686)
root (hd0,0)
kernel /vmlinuz-2.6.38.7-30.fc15.i686 ro root=/dev/mapper/vg_volkov-lv_root rd_LVM_LV=vg_volkov/lv_root rd_LVM_LV=vg_volkov/lv_swap rd_NO_LUKS rd_NO_MD rd_NO_DM LANG=en_US.UTF-8 SYSFONT=latarcyrheb-sun16 KEYTABLE=us 3
initrd /initramfs-2.6.38.7-30.fc15.i686.img
I removed rhgb and quiet from the kernel line, and added a 3. Restarted the VM, and now I had this:
I logged in, and typed the command.
I cringed, closing my eyes, and hit the enter button. I waited a moment, then opened it and saw…
Aha! Protection! Looks like people can’t pull a quick prank and run away without knowing these things. Lets try this one more time..
With another cringe and closed eyes… I hit enter. An awful lot of text flew by, plenty of “operation not permitted.” Looking closely though, the files it was refusing to delete were really just temporary system files. The kind that would disappear at the next restart.
I started off by trying a few commands – ls was the one I wanted to try the most. cd worked, but ls was dead in the water.
I rebooted into the initial Fedora live CD I had used. The filesystem mounted itself, and I took a look inside.
I began browsing each folder. Here was what remained of rm’s total wipe.
/boot – empty.
/dev – 14 items, zero and random being in there, nothing usable though. Folders empty.
/media – nothing
/proc – empty
/run – GDM, console, lock, and such other folders. All were empty.
/selinux – empty
/sys – empty
/var – nfs folder, empty contents.
It wasn’t even possible to boot into this system again – the kernel was gone with grub. In the end, it looks as though rm -rf / truly can wipe out the entire system. The aftermath of such things brings out stories, such as “THE classic Unix horror story”, dating back to 1986 when this once happened. So with this, I leave you a video of rm -rf / on an Ubuntu system, with a great Popcorn Remix:
Filed under Operating Systems Question of the Week
Excellent write-up Simon! Interesting to see just what a simple command like this can do. Perhaps next you can write about fork bombs!
I’ve done this myself intentionally a couple times – first to see what would happen, then to muck-up a system before doing a reinstall (it had upset me).
You [should] be able to use the ever-popular
echo *to show all files in a directory even iflsis kaput. Or,for fname in * ; do echo $fname ; done(Those two don’t work for me under Ubuntu 10.04, however)
I have done this by accident on a live server for shared webhosting (over 200 costumers where on it) I typed something like “#rm -rf /var/www/vhosts/somefolder /” The end / was spaced without me seeing the command. I had run the command many many times before…
To bad centos doesn’t give back this nice warning you got. After a while I noticed a huge amount of warning (like you got and quickly canceled the command). Booting into the system was an impossibility. The mails where gone. The boot folder gone. The only folder left was … /var/ .
So you would think backups …
The person responsible for that just told me they where not existing. The backup server was a new one from the day before and it just so happened that there where no backups from before…
Needless to say we both had a lot of work that day. A lot of angry calls, mails and tickets. And a LOT of explaining to do to the boss.
Yes we where a messy company. Yes the company stopped existing a few years ago. This was my rm -rf story. My former colleagues still haunt me with this from time to time.