/bin /etc /lib64 /root /sbin deleted or moved by mv folder/* /* while su

Question

OS is Centos 6.5 64-bit

I downloaded a tar file and wanted to untar and mv it.

I untared, then accidentally (as root) ran mv folder/* /* instead of mv folder/* . bash said it couldn't overwrite some files, then asked permission for others. I ctrl-c'd out.

I've left terminal session open, but have exited su.

Now I've lost access to most shell commands, can't ls any directories and can't get back to su.

The webserver and services still seem to be running. I can run very few commands, cd is one of them and when I try to cd to /etc or /bin it errors with no directory found.

EDIT Just noticed all folders missing from / (bin,etc,lib64,root,sbin) got moved to /var directory, I tried /var/bin/su & get: -bash: /var/bin/su: /lib64/ld-linux-x86-64.so.2: bad ELF interpreter: No such file or directory

Answer 1

If your system has busybox installed, you can use this to put things back.

busybox is a binary with lots of standard utilities built into it. Things such as mv, sh, ls, etc.

From your comment on Pavel's answer, it sounds like everything ended up in /var. You can try doing /var/bin/busybox mv /var/{bin,etc,lib32,lib64,root,sbin,usr} /. That should get most of your system operational again. There are a few directories such as /tmp which also exist as /var/tmp, so you can't just move them. Hopefully those are the ones that mv complained about and they were left alone.

 

Getting a root shell

You also mentioned that you lost your root shell, and that su is giving you a ld-linux library error. You might be able to use the following:

LD_LIBRARY_PATH=/var/lib64 /var/lib64/ld-linux-x86-64.so.2 /var/bin/su

Note: Upon attempting this, it does not work. This is because su requires several files in /etc (passwd, pam.d, and others). If /etc were still intact, this would have a good chance of succeeding.

 

Without busybox

If you do not have busybox available, you might be able to use the same ld-linux trick as for su:

LD_LIBRARY_PATH=/var/lib64 /var/lib64/ld-linux-x86-64.so.2 /var/bin/mv /var/{bin,etc,lib32,lib64,root,sbin,usr} /

 

From a live CD

As discussed in the comments, if you've lost the root shell, you're pretty much stuck. Basically in order to fix this you need root privileges. The only way to get there is to have a utility such as su or sudo escalate your permissions (both of which are non-functional at this point), or hijack another program already running as root (depending on what's running, not likely possible).

This leaves the only option being a live CD. Once booted into a live CD (or live USB, or whatever), just mount the root volume, and move the affected directories out of /var back to their original home in /.

---

Synopsis of what happened

folder/* would have expanded out to something such as folder/foo and folder/bar.
/* would have expanded out to something like /bin /lib32 /lib64 /etc /home /root /var. Noting that /var is the last item.
So when the shell expanded out all those globs, it would have run something like this:

mv folder/foo folder/bar /bin /lib32 /lib64 /etc /home /root /var

As /var is the last item in the list, everything got moved into it.

---

Why /var/bin/su errors with /lib64/ld-linux-x86-64.so.2: bad ELF interpreter: No such file or directory

Almost all binaries in linux are dynamically linked against ld-linux. ld-linux is the library responsible for loading the other libraries needed by a binary. On your system this lives at /lib64/ld-linux-x86-64.so.2. Since this directory got moved, any dynamically linked executable will no longer work.

The reason busybox works is that busybox is statically linked. It does not use ld-linux.

Answer 2

mv folder/* ./* is wrong as well. You should be more careful about the semantics of the commands you run. The mv command with more than two arguments just takes all argument except the last one and moves the paths they point to into the directory specified in the last argument.

To move all directories (except hidden ones) from folder to the current directory, you should use:

mv folder/* .

You have broken your running system. Your shell and builtin commands continue to work. You will have to boot a live CD and move the directories back. I'm not aware of a bash builtin to move/rename files that would allow you to fix the situation without rebooting, see Patrick's answer for more details.

Answer 3

I accidently moved /usr to /usr_old and everything went to hell. Luckily I stayed in the prompt and was able to execute the following command to restore the usr folder:

LD_LIBRARY_PATH=/usr_old/lib64 /usr_old/lib64/ld-linux-x86-64.so.2 /usr_old/bin/mv /usr_old /usr

Answer 4

IMPORTANT If you're here, and have ran mv incorrectly, can't run shell commands, and folders missing from root directory (/), first of all, if you have SU, DO NOT exit SU until fixed, because you won't get it back. If you are remotely connected, if you disconnect, you will not be able to ssh, leave server alone, don't reboot - most running services should be OK. You can attempt one of the many solutions suggested by Patrick...however you'll likely need physical access if you screwed up like I did.

Once in front of the machine, I rebooted it. As expected, I did receive a kernel panic.

I thought this would be a pretty easy fix, insert livecd, enter rescue mode UP TO THIS POINT IT WAS EASY - then I had to try and mount my root directory. However I needed more than just a simple mount command.

This was because I, like many people, had an lvm file system, and this was the first time I've had to deal with a rescue like this. I had to search the web to see what I needed to do. I've consolidated that information to this post. Here was my process to fix my issue.

1)Inserted Centos_6.4_min cd

2)GUI interface asked what I wanted to do, chose Rescue

3)Rescue tried to mount current system, but indicated I had no Linux partitions

4)Chose to enter shell when option was given

At this point I tried many things to get system mounted, with no luck, I'm pretty sure these are all the steps I had to take (because of lvm):

5)Scanned my volumes,

lvmdiskscan

6)Ran lvscan, showed all listed as "inactive"

lvscan

7)load device module

modprobe dm-mod

8)change the volumes that exist to active

vgchange -ay

9)Ran lvscan again, now all items listed as "active"

10)Created mountpoint & mounted the logical partition

mkdir /mnt/root

mount /dev/VolGroup00/LogVol00 /mnt/root

11)Moved folders back (YOU may need others):

mv /var/{bin,etc,lib64,mnt,root,sbin} /

12)reboot

13) SUCCESS!