0

Assume am in directory /home/userA

There is an environment variabe $XMLFILES that points to /u/xml/xmlfiles. The $XMLFILES environment variable is in userA's environment/profile

I log on as userA then 'su' into userB and i cd into /home/userB/testdata.

I didnt realise that i was userB so i issued the command

rm $XMLFILES/*

And suddenly i see this

bash-3.00$ rm $XMLFILES/*
rm: /bin not removed: Permission denied
rm: /boot is a directory
rm: /cdrom is a directory
rm: /dev is a directory
rm: /devices is a directory
rm: /etc is a directory
rm: /export is a directory
rm: /home is a directory
rm: /kernel is a directory
rm: /lib is a directory
rm: /lost+found is a directory
rm: /mnt is a directory
rm: /net is a directory
rm: /noffprotect: override protection 644 (yes/no)? ^C

I pressed [CTRL+C] as soon as i saw that override protection message. I think since $XMLFILES was null because i was logged on as userB the command that was issued was actually

rm *

Now what i dont understand is why did it try tro delete everything from the root folder? since i was in /home/userB, should it have just tried to delete everything in 'top level of '/home/userB'? the rm command was not even a recursive delete.

Given that the user i was logged on as was not the root user, would this have caused any damage?

2 Answers 2

6

No, since $XMLFILES was empty it tried to remove /*. All that can do is remove files from the root directory, which a normal user isn't supposed to be able to create in the first place.

5
  • But there was no / when i issued the command. Shouldnt it have converted to rm * rather than rm /*
    – ziggy
    Nov 13, 2010 at 19:02
  • The / is right there, in between the $XMLFILES and the *. Nov 13, 2010 at 19:03
  • Ok i see it. Its the / before the *. Stupid me.
    – ziggy
    Nov 13, 2010 at 19:03
  • Do you think this would have caused any damage even though i was not logged on as root?
    – ziggy
    Nov 13, 2010 at 19:03
  • 1
    No, since no normal user is supposed to have write access to / regardless. Nov 13, 2010 at 19:04
2

$XMLFILES would have been an empty string so what you would have actually issued would have been

rm ""/*

which would have been evaluated down to

rm /*

This is why you need to be very careful about using $ variables (i.e. check their existence first) in command line arguments.

1
  • I guess this would not have done any damage as i was not logged on as root.
    – ziggy
    Nov 13, 2010 at 19:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .