8

Just curious, what happens in OS X Maverick if someone issues sudo rm -rf /?
I heard most modern *nix systems are protected from this epic fail.

  • 2
    It just asks you for your admin password. ;) – dwightk Mar 21 '14 at 21:19
13

In the interest of science, a VM died to answer this question:

testrm:~ admin$ sudo rm -rf /

WARNING: Improper use of the sudo command could lead to data loss
or the deletion of important system files. Please double-check your
typing when using sudo. Type "man sudo" for more information.

To proceed, enter your password, or type Ctrl-C to abort.

Password:
rm: /dev/fd/0: Operation not supported
rm: /dev/fd/1: Operation not supported
rm: /dev/fd/2: Operation not supported
rm: /dev/fd/3: Not a directory
rm: /dev/fd/4: Bad file descriptor
rm: /dev/fd: Operation not supported
rm: /dev: Resource busy
rm: /home: Resource busy
rm: /net: Resource busy
rm: /private/var/log: Directory not empty
rm: /private/var/run: Directory not empty
rm: /private/var: Directory not empty
rm: /private: Directory not empty
rm: /System/Library: Directory not empty
rm: /System: Directory not empty
rm: /: Is a directory
testrm:~ admin$ 

Interestingly, it succeeded. Back in the Slackware 2 days, I tried this on Linux and after it deleted the dynamically linked libraries rm was using, it failed.

  • Why were you able to get the prompt at the end? Seems like /bin/bash would crash after being deleted. Or was that just not the entire output? – 0942v8653 Mar 22 '14 at 17:06
  • 4
    Anything that is already loaded into memory is still there. Also, any files that a process has open are still on disk, and the space is not reclaimed until after all close them. So, since bash was running, it could still show its prompt, etc. But it would not be able to load any commands, since they are all gone. Similarly, when I tried this from a terminal on the Mac, instead of doing an ssh in, the finder and UI was still there... But any time a program tried to open a file, it would fail. – Alan Shutko Mar 22 '14 at 17:40
  • This also answers the question I had "What's the last directory to be removed during 'rm -rf /'?", which would seem to be /. So, if I do hit <ctrl-c> in time, that's the place to store my few "must have" files. Any ideas as to how OS and/or version specific that would be? – jalanb Nov 2 '16 at 12:40
  • 1
    @jalanb That is not version specific as all files under / need to be deleted before / can be deleted. However if you are storing these "must have files" you probably want to name them something at the end of the alphabet, as it goes in alphabetical order. – 0942v8653 Aug 30 '17 at 15:06
8

Curiosity killed the cat. Do not, under any circumstances, try this at home. </disclaimer>

There are no protections. The --root-protect option was introduced in GNU rm (on by default).

The rm man page for 10.9 does not mention anything like this. Once you've entered your password, it's all gone. Hope you remembered today is International Backup Day (It's always International Backup Day).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .