Just for info: Never do a "wipe -r .*"

September 04th, 2010 - 11:30 am ET by Markus R. Ke | Report spam
Hi all,

just occured the following:

On one of my Linux notebooks, here Mandriva 2009.1, I had to wipe some
files with wipe version wipe-2.2.0-7mdv2009.1 out of the official
repository.

In /tmp I tried to wipe out some users' "dotted" directories, like /
tmp/.wine* using the syntax known from rm:

[root@linuxnb /tmp]$ wipe -r .*

Unlike rm wipe does NOT stop after erasing the files in the current
directory, but instead it jumps to / and continues there.

Though ".." fits the "-r .*" search pattern, everyone familiar with the
rm -rf syntax and behaviour may recursively "wipe" the whole partition,
resulting in a no longer usable system.

It is very annoying, now to see that even in 2001 there were bug reports
created about this item:

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug1583

In the meantime I verified this on a different box using a "throwaway
account" (the box mentioned above needs to be reinstalled) and wipe
erases everything in the current directory as desired, and then goes
through / into /home and continues its destrucive task. As seen before.

- Be careful with wipe -

Best regards,

Markus

Please reply to group only.
For private email please use http://www.dipl-ing-kessler.de/email.htm
email Follow the discussionReplies 10 repliesReplies Make a reply

Similar topics

Replies

#1 unruh
September 04th, 2010 - 04:26 pm ET | Report spam
On 2010-09-04, Markus R. Ke?ler wrote:
Hi all,

just occured the following:

On one of my Linux notebooks, here Mandriva 2009.1, I had to wipe some
files with wipe version wipe-2.2.0-7mdv2009.1 out of the official
repository.

In /tmp I tried to wipe out some users' "dotted" directories, like /
tmp/.wine* using the syntax known from rm:

[ /tmp]$ wipe -r .*

Unlike rm wipe does NOT stop after erasing the files in the current
directory, but instead it jumps to / and continues there.




Of course. That was what you told it to do. Bash ( not wipe) expands
that * and feeds
wipe -r .. . .wine .bashrc
so there it is, you tell it to wipe .. which is the parent directory.
Please learn how bach expands globs.

Though ".." fits the "-r .*" search pattern, everyone familiar with the
rm -rf syntax and behaviour may recursively "wipe" the whole partition,
resulting in a no longer usable system.

It is very annoying, now to see that even in 2001 there were bug reports
created about this item:

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug1583

In the meantime I verified this on a different box using a "throwaway
account" (the box mentioned above needs to be reinstalled) and wipe
erases everything in the current directory as desired, and then goes
through / into /home and continues its destrucive task. As seen before.

- Be careful with wipe -

Best regards,

Markus

Replies Reply to this message
#2 Markus R. Ke
September 04th, 2010 - 05:22 pm ET | Report spam
Am Sat, 04 Sep 2010 20:26:41 +0000 schrieb unruh:

On 2010-09-04, Markus R. Ke?ler wrote:
Hi all,

just occured the following:

On one of my Linux notebooks, here Mandriva 2009.1, I had to wipe some
files with wipe version wipe-2.2.0-7mdv2009.1 out of the official
repository.

In /tmp I tried to wipe out some users' "dotted" directories, like /
tmp/.wine* using the syntax known from rm:

[ /tmp]$ wipe -r .*

Unlike rm wipe does NOT stop after erasing the files in the current
directory, but instead it jumps to / and continues there.




Of course. That was what you told it to do. Bash ( not wipe) expands
that * and feeds
wipe -r .. . .wine .bashrc
so there it is, you tell it to wipe .. which is the parent directory.
Please learn how bach expands globs.

Though ".." fits the "-r .*" search pattern, everyone familiar with the
rm -rf syntax and behaviour may recursively "wipe" the whole partition,
resulting in a no longer usable system.

It is very annoying, now to see that even in 2001 there were bug
reports created about this item:

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug1583

In the meantime I verified this on a different box using a "throwaway
account" (the box mentioned above needs to be reinstalled) and wipe
erases everything in the current directory as desired, and then goes
through / into /home and continues its destrucive task. As seen before.

- Be careful with wipe -






I said that the pattern matches, or in other words, the shell translates
it to "..". You're right - so far, but not farther.

What I also explained is that people which are used to work with the rm
command in any constellation would, by instinct, assume, that wipe
behaves in the same way. But it does NOT. The rm command in some way
"catches" such patterns and excludes them from the parameters it gets
from the shell. - Wipe does not.

That's the point.



/home/dimke/.pan2/signatur.txt
Replies Reply to this message
#3 Robert Riches
September 04th, 2010 - 11:55 pm ET | Report spam
On 2010-09-04, Markus R. Keßler wrote:
Am Sat, 04 Sep 2010 20:26:41 +0000 schrieb unruh:

On 2010-09-04, Markus R. Ke?ler wrote:
Hi all,

just occured the following:

On one of my Linux notebooks, here Mandriva 2009.1, I had to wipe some
files with wipe version wipe-2.2.0-7mdv2009.1 out of the official
repository.

In /tmp I tried to wipe out some users' "dotted" directories, like /
tmp/.wine* using the syntax known from rm:

[ /tmp]$ wipe -r .*

Unlike rm wipe does NOT stop after erasing the files in the current
directory, but instead it jumps to / and continues there.




Of course. That was what you told it to do. Bash ( not wipe) expands
that * and feeds
wipe -r .. . .wine .bashrc
so there it is, you tell it to wipe .. which is the parent directory.
Please learn how bach expands globs.

Though ".." fits the "-r .*" search pattern, everyone familiar with the
rm -rf syntax and behaviour may recursively "wipe" the whole partition,
resulting in a no longer usable system.

It is very annoying, now to see that even in 2001 there were bug
reports created about this item:

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug1583

In the meantime I verified this on a different box using a "throwaway
account" (the box mentioned above needs to be reinstalled) and wipe
erases everything in the current directory as desired, and then goes
through / into /home and continues its destrucive task. As seen before.

- Be careful with wipe -






I said that the pattern matches, or in other words, the shell translates
it to "..". You're right - so far, but not farther.

What I also explained is that people which are used to work with the rm
command in any constellation would, by instinct, assume, that wipe
behaves in the same way. But it does NOT. The rm command in some way
"catches" such patterns and excludes them from the parameters it gets
from the shell. - Wipe does not.

That's the point.



Suggestions for safety's sake:

If you want to specify the dot files but avoid picking up
. and .. one trick is to specify '.??*' (without the
quotation marks). That will miss any dot files with only one
character after the dot, but those are very rare.

When working with a potentially dangerous command, first do
'du' or 'file' or something benign on the argument your are
thinking of using. If that gets the right set of files,
_THEN_, _CAREFULLY_, do the dangerous command and specify !$
or !* or something similar.

HTH

Robert Riches

(Yes, that is one of my email addresses.)
Replies Reply to this message
#4 Markus R. Keßler
September 05th, 2010 - 07:25 am ET | Report spam
Am Sun, 05 Sep 2010 03:55:39 +0000 schrieb Robert Riches:

On 2010-09-04, Markus R. Keßler wrote:
Am Sat, 04 Sep 2010 20:26:41 +0000 schrieb unruh:

On 2010-09-04, Markus R. Ke?ler wrote:
Hi all,

just occured the following:

On one of my Linux notebooks, here Mandriva 2009.1, I had to wipe some
files with wipe version wipe-2.2.0-7mdv2009.1 out of the official
repository.

In /tmp I tried to wipe out some users' "dotted" directories, like /
tmp/.wine* using the syntax known from rm:

[ /tmp]$ wipe -r .*

Unlike rm wipe does NOT stop after erasing the files in the current
directory, but instead it jumps to / and continues there.




Of course. That was what you told it to do. Bash ( not wipe) expands
that * and feeds
wipe -r .. . .wine .bashrc
so there it is, you tell it to wipe .. which is the parent directory.
Please learn how bach expands globs.

Though ".." fits the "-r .*" search pattern, everyone familiar with the
rm -rf syntax and behaviour may recursively "wipe" the whole partition,
resulting in a no longer usable system.

It is very annoying, now to see that even in 2001 there were bug
reports created about this item:

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug1583

In the meantime I verified this on a different box using a "throwaway
account" (the box mentioned above needs to be reinstalled) and wipe
erases everything in the current directory as desired, and then goes
through / into /home and continues its destrucive task. As seen before.

- Be careful with wipe -






I said that the pattern matches, or in other words, the shell translates
it to "..". You're right - so far, but not farther.

What I also explained is that people which are used to work with the rm
command in any constellation would, by instinct, assume, that wipe
behaves in the same way. But it does NOT. The rm command in some way
"catches" such patterns and excludes them from the parameters it gets
from the shell. - Wipe does not.

That's the point.



Suggestions for safety's sake:

If you want to specify the dot files but avoid picking up
. and .. one trick is to specify '.??*' (without the
quotation marks). That will miss any dot files with only one
character after the dot, but those are very rare.

When working with a potentially dangerous command, first do
'du' or 'file' or something benign on the argument your are
thinking of using. If that gets the right set of files,
_THEN_, _CAREFULLY_, do the dangerous command and specify !$
or !* or something similar.

HTH



Hi Robert,

I fully agree with you that it is always a good idea to safely test
suspicious applications first.

But even other commands, like "find" behave like "rm":

/*

[1004 tmp]$ find . -iname '.*'
.
./.wine-dimke
./.ICE-unix
./.font-unix
./.X11-unix

*/

So, the worst thing that could theoretically happen here is that the whole
/tmp would be erased, but NOT the parent directory if you do a "cd /tmp ;
find . -iname '.*' | xargs rm -rf".

The reason why I wrote the original message is, that people likely assume
"wipe" to behave similarly to "rm", including myself.
And this is not the case.

Even worse: In the manual there's no hint about that, though people were
angrily talking about this behaviour for almost ten years, see 1. posting.

Markus

Please reply to group only.
For private email please use http://www.dipl-ing-kessler.de/email.htm
Replies Reply to this message
#5 FP
September 06th, 2010 - 09:11 am ET | Report spam
On 05/09/2010 12:25, Markus R. Keßler wrote:
Am Sun, 05 Sep 2010 03:55:39 +0000 schrieb Robert Riches:

On 2010-09-04, Markus R. Keßler wrote:
Am Sat, 04 Sep 2010 20:26:41 +0000 schrieb unruh:

On 2010-09-04, Markus R. Ke?ler wrote:
Hi all,

just occured the following:

On one of my Linux notebooks, here Mandriva 2009.1, I had to wipe some
files with wipe version wipe-2.2.0-7mdv2009.1 out of the official
repository.

In /tmp I tried to wipe out some users' "dotted" directories, like /
tmp/.wine* using the syntax known from rm:

[ /tmp]$ wipe -r .*

Unlike rm wipe does NOT stop after erasing the files in the current
directory, but instead it jumps to / and continues there.











...

But even other commands, like "find" behave like "rm":

/*

[1004 tmp]$ find . -iname '.*'
.
./.wine-dimke
./.ICE-unix
./.font-unix
./.X11-unix

*/



That's not the same thing at all! There is a significant difference
between .* and '.*'

So, the worst thing that could theoretically happen here is that the whole
/tmp would be erased, but NOT the parent directory if you do a "cd /tmp ;
find . -iname '.*' | xargs rm -rf".

The reason why I wrote the original message is, that people likely assume
"wipe" to behave similarly to "rm", including myself.
And this is not the case.



Are you really sure about that? If you want to try
rm -rf .* &
then please try it on a freshly installed clean test machine, not
something that has important stuff... but read this first:

http://www.softpanorama.org/Admin/H...ders.shtml

(pardon the line wrap).

FP
Replies Reply to this message
Help Create a new topicNext page Replies Make a reply
Search Make your own search