As everyone knows, these are two deadly unix commands that both tell a machine to commit suicide. But what is the difference between the two? The first one deletes the root directory, while the second one deletes everything in it. Both are equally bad, but will the first one delete the filesystem because it deletes the root directory itself? What is the difference?

  • 3
    Try both command once and figure out the difference – SHW Aug 10 '16 at 6:12
  • Well, one difference is that --no-preserve-root is a GNU option. – Kusalananda Aug 10 '16 at 7:23

The same difference as with rm -r dir and rm -r dir/*.

The second only removes whatever the glob matches, usually every file whose name doesn't start with a dot, but can be configured in bash and likely others. It also fails if you have lots of files in the directory since the command line can only fit so much. Not that you'd usually have either in the root directory, but still.

The first one will recurse into dir, removing all contents, and then the directory itself. But as said, you can't remove the root directory anyway. On Linux, the error you get is Device or resource busy, which is exactly what you get trying to remove any directory holding a mounted filesystem. (It doesn't even bother checking if the directory is empty before dropping that.)

For the same reason, you can't usually get the root directory empty either, you'll have stuff like /proc and /sys (on Linux) mounted, and you can't remove the mount points without unmounting them.

And well, strictly speaking, removing all files doesn't kill the system... It just makes the usual paradigm of launching external programs to do stuff a bit hard to use. But running programs that don't need any files on the file system any longer wouldn't be affected. You might be able to try it with something like the busybox shell, that has integrated rm and ls. (Booting up the next time might be hard though, if your boot files were on a mounted filesystem.)

  • »removing all files doesn't kill the system« I beg to differ. When removing everything the system can shut down on its own. I experienced it myself once. This user too. You can even brick your system if you have mounted UEFI variables (systemd mounts them automatically). – Socowi Apr 24 at 9:19

--no-preserve-root bypasses the opposite --preserve-root directive which could be set as an alias or even a default option in rm depending on the system. This option is merely a super newbie protection which won't protect the system much against someone who would run such a command in the first place.

If there is no --preserver-root directive (bypassed or default), rm will attempt to delete everything on the system.

Note that it will always fail to do so as there are many files which it will not be able to delete because they are open. Also note that / is a kernel construct and could not be deleted in any case, even if it were possible to delete all its mounted content.

  • 1
    Usually open files (their names) can also be removed. – ilkkachu Aug 10 '16 at 8:21
  • That also depends on the OS. I understand how the directory structure works but older versions of Linux failed on an open file. I just did the test on a running program and was indeed able to delete its file. I suspect it's probably related to the filesystem. – Julie Pelletier Aug 10 '16 at 15:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.