9

Just curious, what happens in OS X Maverick if someone issues sudo rm -rf /?
I heard most modern *nix systems are protected from this epic fail.

bmike
  • 235,889
Chelios
  • 190

1 Answers1

16

In the interest of science, a VM died to answer this question:

testrm:~ admin$ sudo rm -rf /

WARNING: Improper use of the sudo command could lead to data loss
or the deletion of important system files. Please double-check your
typing when using sudo. Type "man sudo" for more information.

To proceed, enter your password, or type Ctrl-C to abort.

Password:
rm: /dev/fd/0: Operation not supported
rm: /dev/fd/1: Operation not supported
rm: /dev/fd/2: Operation not supported
rm: /dev/fd/3: Not a directory
rm: /dev/fd/4: Bad file descriptor
rm: /dev/fd: Operation not supported
rm: /dev: Resource busy
rm: /home: Resource busy
rm: /net: Resource busy
rm: /private/var/log: Directory not empty
rm: /private/var/run: Directory not empty
rm: /private/var: Directory not empty
rm: /private: Directory not empty
rm: /System/Library: Directory not empty
rm: /System: Directory not empty
rm: /: Is a directory
testrm:~ admin$

Interestingly, it succeeded. Back in the Slackware 2 days, I tried this on Linux and after it deleted the dynamically linked libraries rm was using, it failed.

Alan Shutko
  • 12,401
  • Why were you able to get the prompt at the end? Seems like /bin/bash would crash after being deleted. Or was that just not the entire output? – 0942v8653 Mar 22 '14 at 17:06
  • 4
    Anything that is already loaded into memory is still there. Also, any files that a process has open are still on disk, and the space is not reclaimed until after all close them. So, since bash was running, it could still show its prompt, etc. But it would not be able to load any commands, since they are all gone. Similarly, when I tried this from a terminal on the Mac, instead of doing an ssh in, the finder and UI was still there... But any time a program tried to open a file, it would fail. – Alan Shutko Mar 22 '14 at 17:40
  • This also answers the question I had "What's the last directory to be removed during 'rm -rf /'?", which would seem to be /. So, if I do hit in time, that's the place to store my few "must have" files.

    Any ideas as to how OS and/or version specific that would be?

     – jalanb Nov 02 '16 at 12:40
  • 1
    @jalanb That is not version specific as all files under / need to be deleted before / can be deleted. However if you are storing these "must have files" you probably want to name them something at the end of the alphabet, as it goes in alphabetical order. – 0942v8653 Aug 30 '17 at 15:06