Question

When logged in as the root user, how often would you do the command rm -rf / ?

Answer 1

How often you can get, it's basically depend on the specific Unix/Linux distributions.

- rm command would be removed with it as well as any other standard command in /bin and other folders.

Here is the simple test which I've performed in Linux Ubuntu 15.04 using VM.

1. Initialize virtual machine via vagrant:

   vagrant init ubuntu/vivid64 && vagrant up --provider virtualbox && vagrant ssh 

2. Then when you're trying to remove all the files in the standard way, it doesn't let you:

   vagrant@vagrant-ubuntu-vivid-64:~$ sudo rm -fr / rm: it is dangerous to operate recursively on '/' rm: use --no-preserve-root to override this failsafe 

3. So lets try --no-preserve-root. Always double check you're logged in virtual machine (so you're having vagrant@vagrant-ubuntu-vivid-64:~$), then run (don't try that at home):

   vagrant@vagrant-ubuntu-vivid-64:~$ sudo rm -vfr --no-preserve-root / removed directory: '/lost+found' removed directory: '/opt' removed '/bin/nc' removed '/bin/less' removed '/bin/wdctl' removed '/bin/nano' ... removed '/bin/rmdir' removed '/bin/sh' removed '/bin/rm' ... removed directory: '/bin' removed directory: '/usr/games' removed '/usr/bin/byobu-launcher-install' removed '/usr/bin/ipcmk' removed '/usr/bin/sum' removed directory: '/usr/bin' removed '/usr/lib/gcc/x86_64-linux-gnu/4.9.2' removed '/usr/lib/gcc/x86_64-linux-gnu/5.0.1' removed directory: '/usr/lib/gcc/x86_64-linux-gnu/5' removed '/usr/lib/gcc/x86_64-linux-gnu/4.9/libquadmath.so' removed '/usr/lib/gcc/x86_64-linux-gnu/4.9/libgomp.so' ... removed directory: '/run/initramfs' removed directory: '/media' rm: cannot remove '/proc/fb': Operation not permitted rm: cannot remove '/proc/fs/ext4/sda1/options': Operation not permitted ... removed '/vmlinuz' removed '/boot/config-3.19.0-23-generic' removed '/boot/grub/grubenv' ... removed directory: '/boot' removed '/lib64/ld-linux-x86-64.so.2' rm: cannot remove '/dev/hugepages': Device or resource busy rm: cannot remove '/dev/mqueue': Device or resource busy rm: cannot remove '/dev/shm': Device or resource busy removed '/dev/vcsa7' ... removed '/dev/mem' removed '/dev/rfkill' removed '/dev/vga_arbiter' ... rm: cannot remove '/sys/fs/ecryptfs/version': Operation not permitted removed directory: '/etc' removed directory: '/mnt' removed '/vagrant/.vagrant/machines/default/virtualbox/action_provision' removed '/vagrant/.vagrant/machines/default/virtualbox/action_set_name' removed '/vagrant/.vagrant/machines/default/virtualbox/creator_uid' removed '/vagrant/.vagrant/machines/default/virtualbox/id' removed '/vagrant/.vagrant/machines/default/virtualbox/index_uuid' removed '/vagrant/.vagrant/machines/default/virtualbox/private_key' removed '/vagrant/.vagrant/machines/default/virtualbox/synced_folders' removed directory: '/vagrant/.vagrant/machines/default/virtualbox' removed directory: '/vagrant/.vagrant/machines/default' removed directory: '/vagrant/.vagrant/machines' removed directory: '/vagrant/.vagrant' removed '/vagrant/Vagrantfile' rm: cannot remove '/vagrant': Device or resource busy 

   After that it gets back to the shell prompt like nothing just happened, but you can't execute any commands anymore apart of few built in and kill, so you can finish your job and kill your session:)

   For example:

   $ rm rm: command not found $ kill kill: usage: kill [-s sigspec | -n signum | -sigspec] pid | jobspec ... or kill -l [sigspec] $ which kill -bash: /usr/bin/which: No such file or directory $ kill -9 $$ Connection to 127.0.0.1 closed. 

So it pretty removed everything, including rm, ls and all other commands, but still you're logged-in. There are some special folders which weren't removed such as some devices from /dev, /proc or /sys which are aren't regular directories/files, but it's pseudo-filesystem providing interfaces to process and kernel data.