3

So, in the process of debugging a build process for a software package I accidentally ran the command rm -rf build /* as a non-root user on my laptop. I stopped the command as soon as I saw permission denied errors for trying to remove the contents of /etc.

I'm not sure how far through the filesystem it went or what could have been deleted that could stop my system from working should I reboot it (It's still running at the moment).

My immediate thoughts are to make sure my home directory backup is current (I use Crashplan, last backup finished about 10 minutes before my mistake), retrieve a list of installed packages from dnf and re-install the OS from scratch but that seems like a bit of a nuclear option.

Is there any way of checking which files were deleted (outside my home directory) and possibly repairing the OS without having to re-install?

Background: Laptop is running latest version of Fedora Workstation, EFI boot partition is on a separate drive but mounted at boot so could have been affected. There are some directories and files missing from my home directory so it seems the command got that far and possibly further.

1 Answer 1

7

Since you ran the command rm -rf / as non-root user (assuming - your user), the command will delete only files owned by your non-root user:

  • It seems that most of the files owned by your user will be in the home directory (and some in /tmp).

Also the rm -rf / command might delete files which are group write-able by one of the groups your user belong to.

  • Most of the files shouldn't be write-able for group

Restoring your home directory should be good enough in most cases

3
  • 4
    There's a reasonable chance that if you "stopped ... as soon as I saw permission denied errors for /etc" then nothing was actually deleted - /bin, /boot, /dev, /etc all precede /home in /* expansion, and nothing in them should be deletable. Jun 15, 2017 at 10:04
  • @MichaelHomer That's what I think but given that some of the files in my home directory have been deleted I think it might have gone further than that.
    – RobbG
    Jun 15, 2017 at 10:21
  • @RobbG It should only be the files in build which was deleted. Your command was rm -rf build /* and you can see how it would expand with echo rm -rf build /* and here I guess /home comes after /etc.
    – hschou
    Jun 15, 2017 at 11:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .