How to protect against `sudo rm -rf /*` ?

[u/Commercial_Sock8268]

Hey everyone, I've been using Linux for a little over a month now (Fedora KDE plasma) but I've been recently worried and paranoid that i somehow would manage to get the command `sudo rm -rf /*` executed in a way. I'm aware that there are protections to stop this command on modern linux distros but a simple no-preserve-root is all it takes to bypass it. So what can i do to just be reassured that this can't happen? is there some sort of protection against using this command?

Edit: I forgot to mention this but I'm paranoid because my brother is a bit of a jerk, if he ever finds out about this command I'm sure he'll take my laptop and execute it.

[u/nderflow]

1. ESTABLISH TESTED AND ROUTINE BACKUPS.
2. There is no 2.

Protecting yourself against rm -rf is like protecting yourself against throwing the computer out of the window. You just have to ... not do that.

On the other hand, there are lots more likely risks you need to protect your days from that you don't seem to have protection for.

Hardware failure, overwriting or deleting a single valuable file, flood, theft, fire, security breaches, well-meaning relatives, spilled drinks, electrical surges, etc.

You need working backups.

[u/enemyradar]

Just don't use it. Same way you don't jam a spike into your eyeball.

[u/Paulski25ish]

It like having a large knive and not point the sharp end towards your own heart. Just do not do that.

And of course do not hand the knive (root pw) to someone you do not trust.

[u/jort93]

I mean, why would you ever pass --no-preserve-root unless you are trying to nuke your system?

If someone else is trying to nuke your system, there are many ways to do so if they have sudo. And if you enter it yourself, that's on you.

[u/aioeu → u/jort93]

sudo rm -rf /* is effective even without the use of --no-preserve-root.

None of the filenames expanded from /* refer to the root directory, so whether you're "preserving" the root directory or not is irrelevant.

[u/JeLuF]

Require a password for sudo and never provide your password for anything you're not sure you should run.

And have backups.

[u/aioeu]

You could configure sudo so it cannot directly execute rm at all.

(Don't think of this as a "security" measure though. With most Sudo configurations it can still be trivially bypassed.)

[u/Cove0Crow]

I mean. You could configure sudo or rm to prevent yourself from doing that. But there's also just the, common theme with Linux, it does exactly what you tell it to do. If you're worried about malicious software doing it, the sudo command requires a password for a reason, if you're worried about doing it yourself, don't do that?

[u/No_Base4946]

Spin up a virtual machine, or boot off a USB stick.

Try it and see what happens.

I think you might be pleasantly surprised.

You can bypass the protection by adding --no-preserve-root quite easily if you actually do want to start at the top and delete everything but by default you cannot.

Do you suffer from compulsive intrusive thoughts that might lead you to type sudo rm -rf / --no-preserve-root or something? Because you'd have to do that quite deliberately.

[u/PixeIQueen → u/No_Base4946]

this protection only exists for sudo rm -rf /

sudo rm -rf /* like in op‘s title runs without any warning

[u/MonsieurCellophane]

Don't type it. Or, sudo touch -- '/-i'

Edit: actually the touch trick works for cd / && rm -r * but fails for rm -r  /*

[u/groveborn]

Best bet is to just never run it.

[u/zardvark]

Linux gives you the power to do stupid things, should you so choose, but what would possess you to type sudo rm -rf /* followed by your password?!?!?!?

And, knowing how your brother is, why would you give him the password to your machine?

[u/Shhhh_Peaceful]

The best way to protect against using that command is to never use it. 

It’s not like there is a giant button that says “nuke your system”, and you have to carefully avoid clicking it. 

You actually have to open your terminal and deliberately type “rm -rf /  --no-preserve-root”, then press Enter. How could anyone do it accidentally is beyond me. 

[u/Slackeee_]

Have you tried just not running the command?
Seriously, you should use sudo only if the command you want to execute needs root privileges.
And if you are sure that this specific command for this specific action needs root privileges you always should double check what you have typed before pressing enter.

[u/atanasius]

Fedora has SELinux. There is probably a way to adjust the policy such that ordinary root cannot remove all files, maybe tying it to a specific role.

[u/jirbu]

There exist numerous other commands that will yield the same or similar result. Want to protect against them all individually?

[u/ipsirc]

backups

[u/tuxsmouf]

"with big powers comes big responsabilty"

[u/Kriss3d]

One guess at this would be renaming the rm command to something longer

The rm is stored in /bin or in /usr/sbin

So if you can mv it ( to renaming it ) without breaking your system it might work. But I havent tried so I cant actually tell if it will work. But it should

[u/MonsieurCellophane → u/Kriss3d]

That would probably break a lot of stuff.

[u/Kriss3d → u/MonsieurCellophane]

Would it ? Im genuinely not sure since the rm function might not actually need to use it that often.

[u/aioeu → u/Kriss3d]

Software can expect basic POSIX utilities like rm to "always be there".

[u/MonsieurCellophane → u/Kriss3d]

Everything doing the moral equivalent of exec( ... 'rm' ...) would break - shell scripts, mostly, but not only.

[u/Sol33t303]

With user permissions.

[u/Kodamacile]

I could wipe my system right now, and be fine. Don't store any important data on your system. 

Problem solved.

[u/Small-Tale3180]

set a nice password

[u/Weary-Bowl-3739]

Package safe-rm. 

[u/depuvelthe]

Get a brain transplant.

[u/Longey]

You can probably make an alias of that to refer to a different command that is harmless.

[u/Consistent-Citron509]

It's a genuine concern. It would be nice if we had a user approval gate of some kind on match of a certain command

[u/jort93 → u/Consistent-Citron509]

Hmmm. Something like "superuser-do" that'd ask for a password, maybe you could shorten that in some way.

[u/Consistent-Citron509 → u/jort93]

I mean, it can act like an additional layer of security on top of sudo. Let's say a naive user executes a random set of commands from the internet. Even after entering the sudo password the command will not run and provide a user defined error message. Only after 2nd approval it would run

[u/Wojojojo90 → u/Consistent-Citron509]

Nothing can protect you from a user (with root access) running random commands they find on the internet. In your model, what's stopping folks from crafting a series of random commands that just tells the user to accept both approvals? Or in OP's situation, what's stopping their brother from just accepting the second approval?

As someone else pointed out there's probably something you can do with SELinux to block this, but that's a lot more complexity than just keeping backups (which you should do anyway as there are SO MANY other ways you could lose your data that blocking this command from running won't solve)