From owner-freebsd-hackers@FreeBSD.ORG  Sun Oct  3 06:31:30 2004
Return-Path: <owner-freebsd-hackers@FreeBSD.ORG>
Delivered-To: freebsd-hackers@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP
	id 55D6116A4CE; Sun,  3 Oct 2004 06:31:30 +0000 (GMT)
Received: from VARK.MIT.EDU (VARK.MIT.EDU [18.95.3.179])
	by mx1.FreeBSD.org (Postfix) with ESMTP
	id 07B7743D1D; Sun,  3 Oct 2004 06:31:30 +0000 (GMT)
	(envelope-from das@FreeBSD.ORG)
Received: from VARK.MIT.EDU (localhost [127.0.0.1])
	by VARK.MIT.EDU (8.13.1/8.12.10) with ESMTP id i936VfkF004972;
	Sun, 3 Oct 2004 02:31:41 -0400 (EDT)
	(envelope-from das@FreeBSD.ORG)
Received: (from das@localhost)
	by VARK.MIT.EDU (8.13.1/8.12.10/Submit) id i936VfYa004971;
	Sun, 3 Oct 2004 02:31:41 -0400 (EDT)
	(envelope-from das@FreeBSD.ORG)
Date: Sun, 3 Oct 2004 02:31:41 -0400
From: David Schultz <das@FreeBSD.ORG>
To: "M. Warner Losh" <imp@bsdimp.com>
Message-ID: <20041003063141.GA4817@VARK.MIT.EDU>
Mail-Followup-To: "M. Warner Losh" <imp@bsdimp.com>,
	keramida@FreeBSD.ORG, freebsd-hackers@FreeBSD.ORG
References: <20041002210554.GS35869@seekingfire.com>
	<20041002.192951.35870461.imp@bsdimp.com> <20041003015321.GA3190@gothmog.gr>
	<20041002.200645.21077766.imp@bsdimp.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20041002.200645.21077766.imp@bsdimp.com>
cc: freebsd-hackers@FreeBSD.ORG
cc: keramida@FreeBSD.ORG
Subject: Re: Protection from the dreaded "rm -fr /"
X-BeenThere: freebsd-hackers@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Technical Discussions relating to FreeBSD
	<freebsd-hackers.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-hackers>,
	<mailto:freebsd-hackers-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-hackers>
List-Post: <mailto:freebsd-hackers@freebsd.org>
List-Help: <mailto:freebsd-hackers-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-hackers>,
	<mailto:freebsd-hackers-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sun, 03 Oct 2004 06:31:30 -0000

On Sat, Oct 02, 2004, M. Warner Losh wrote:
> In message: <20041003015321.GA3190@gothmog.gr>
>             Giorgos Keramidas <keramida@freebsd.org> writes:
> : On 2004-10-02 19:29, "M. Warner Losh" <imp@bsdimp.com> wrote:
> : > In message: <20041002210554.GS35869@seekingfire.com>
> : >             Tillman Hodgson <tillman@seekingfire.com> writes:
> : > : It'll never work, though, that's the thing. At some point it'll rm
> : > : something it itself needs and error out. There isn't a way to use `rm
> : > : -rf /` that /doesn't/ result in foot-shooting.
> : >
> : > No.  You are wrong.  if you rm -rf in a chroot, then it won't result
> : > in foot shooting, necessarily, like it would outside a chroot.
> : 
> : Since a chroot can always be rm -fr deleted from outside the chroot,
> : this isn't really a great problem, is it?
> 
> You miss the point.
> 
> You said it was always a foot-shooting move.  I gave you a concrete
> example of where it wasn't a foot-shooting move (or even when you
> could use newfs instead).  You reply with a workaround (which may be a
> valid way to deal, maybe not).  My point still stands: it isn't always
> a foot-shooting move.

This is the only convincing argument against the proposed change
that I've heard yet.  I was assuming that doing this would cause
something (e.g. the shell) to blow up even within a chroot, but I
guess that isn't true, since all of the needed inodes will still
be referenced until the shell exits.

I guess to make this feature justifiable under the ``you are
definitely trying to shoot yourself in the foot'' criterion, it
would need to be disabled in chrooted environments.  AFAIK, there
isn't a simple way to detect chrootedness from userland, so this
is starting to sound like a much larger kludge than I originally
thought...