Date: Sun, 3 Oct 2004 02:31:41 -0400 From: David Schultz <das@FreeBSD.ORG> To: "M. Warner Losh" <imp@bsdimp.com> Cc: keramida@FreeBSD.ORG Subject: Re: Protection from the dreaded "rm -fr /" Message-ID: <20041003063141.GA4817@VARK.MIT.EDU> In-Reply-To: <20041002.200645.21077766.imp@bsdimp.com> References: <20041002210554.GS35869@seekingfire.com> <20041002.192951.35870461.imp@bsdimp.com> <20041003015321.GA3190@gothmog.gr> <20041002.200645.21077766.imp@bsdimp.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Sat, Oct 02, 2004, M. Warner Losh wrote: > In message: <20041003015321.GA3190@gothmog.gr> > Giorgos Keramidas <keramida@freebsd.org> writes: > : On 2004-10-02 19:29, "M. Warner Losh" <imp@bsdimp.com> wrote: > : > In message: <20041002210554.GS35869@seekingfire.com> > : > Tillman Hodgson <tillman@seekingfire.com> writes: > : > : It'll never work, though, that's the thing. At some point it'll rm > : > : something it itself needs and error out. There isn't a way to use `rm > : > : -rf /` that /doesn't/ result in foot-shooting. > : > > : > No. You are wrong. if you rm -rf in a chroot, then it won't result > : > in foot shooting, necessarily, like it would outside a chroot. > : > : Since a chroot can always be rm -fr deleted from outside the chroot, > : this isn't really a great problem, is it? > > You miss the point. > > You said it was always a foot-shooting move. I gave you a concrete > example of where it wasn't a foot-shooting move (or even when you > could use newfs instead). You reply with a workaround (which may be a > valid way to deal, maybe not). My point still stands: it isn't always > a foot-shooting move. This is the only convincing argument against the proposed change that I've heard yet. I was assuming that doing this would cause something (e.g. the shell) to blow up even within a chroot, but I guess that isn't true, since all of the needed inodes will still be referenced until the shell exits. I guess to make this feature justifiable under the ``you are definitely trying to shoot yourself in the foot'' criterion, it would need to be disabled in chrooted environments. AFAIK, there isn't a simple way to detect chrootedness from userland, so this is starting to sound like a much larger kludge than I originally thought...
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20041003063141.GA4817>