27

Playing with e2fsprogs debugfs, by change/accident, a file named filen/ame was created. Obviously the forward slash character / serves as the special separator character in pathnames.

Still using debugfs I wanted to remove the file named filen/ame, but I had little success, since the / character is not interpreted as part of the filename?

Does debugfs provide a way to remove this file containing the slash? If so how?

I used:

cd /tmp
echo "content" > contentfile
dd if=/dev/zero of=/tmp/ext4fs bs=1M count=50
mkfs.ext4 /tmp/ext4fs
debugfs -w -R "write /tmp/contentfile filen/ame" /tmp/ext4fs
debugfs -w -R "ls" /tmp/ext4fs

which outputs:

debugfs 1.43.4 (31-Jan-2017)
 2  (12) .    2  (12) ..    11  (20) lost+found    12  (980) filen/ame

I tried the following to remove the filen/ame file:

debugfs -w -R "rm filen/ame" /tmp/ext4fs

but this did not work and only produced:

debugfs 1.43.4 (31-Jan-2017)
rm: File not found by ext2_lookup while trying to resolve filename

Apart from changing the content of the directory node manually, is there a way to remove the file using debugfs ?

2
  • Does escaping the forwardslash (filen\/ame) not work?
    – JAB
    Commented Mar 20, 2017 at 18:00
  • 17
    +1, and congratulations. You've managed to find one of the only two cases of "weird character in file name" where just correctly quoting and/or escaping the character in a shell command won't solve the problem. (The other one would be a null byte in a file name, although I suspect that, on most filesystems, that would just truncate the name.) Commented Mar 20, 2017 at 18:22

3 Answers 3

32

If you want a fix and are not just trying out debugfs, you can have fsck do the work for you. Mark the filesystem as dirty and run fsck -y to get the filename changed:

$ debugfs -w -R "dirty" /tmp/ext4fs
$ fsck -y /tmp/ext4fs
 ...
/tmp/ext4fs was not cleanly unmounted, check forced.
Pass 1: Checking inodes, blocks, and sizes
Pass 2: Checking directory structure
Entry 'filen/ame' in / (2) has illegal characters in its name.
Fix? yes
 ...
$ debugfs -w -R "ls" /tmp/ext4fs
2  (12) .    2  (12) ..    11  (20) lost+found    12  (980) filen.ame   
1
  • 3
    e2fsck has a -force option that will lead to a full check “even if the file system seems clean”. Commented Mar 20, 2017 at 21:26
3

Congradulations on fsck working; if for some reason it didn't work the answer is ls -i1 followed by umount and then clri.

Ref: http://docstore.mik.ua/orelly/unix/upt/ch23_13.htm

I have actually tested this method.

4
  • If this is Linux (which it seems like), it's worth noting that clri isn't a separate command (as it is on some other Unix systems), it's a subcommand inside debugfs.
    – hobbs
    Commented Mar 20, 2017 at 18:45
  • @hobbs: must make mine unusual then. Oh wait, nvm clri was just echo "clri $2" | debugfs "$1"
    – Joshua
    Commented Mar 20, 2017 at 18:50
  • Your instructions require running fsck anyway - which will fix the problem, with the message Entry 'filen/ame' in / (2) has deleted/unused inode 12. Clear<y>? instead of the one noted in the other answer - but doing the clri is an extra step. There doesn't seem to be a way to resolve this purely from within debugfs.
    – Random832
    Commented Mar 20, 2017 at 18:54
  • @Random832: I had fsck not fix it of its own in ages past. :(
    – Joshua
    Commented Mar 20, 2017 at 18:56
-1

If you move the file to a directory, you can then delete the directory with the file in it.

mkdir foo 
mv filen* foo
rm -rf foo
1
  • 2
    This would work for any other awkward filename, but it won't work for a filename that has / in it.
    – zwol
    Commented May 7, 2018 at 20:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .