I think this is a more reliable way of detecting rm -rf /. Previous effort was reverted due to false positives.
Index: rm.c =================================================================== RCS file: /cvs/src/bin/rm/rm.c,v retrieving revision 1.36 diff -u -p -r1.36 rm.c --- rm.c 1 Feb 2016 22:34:19 -0000 1.36 +++ rm.c 15 Apr 2016 17:59:35 -0000 @@ -395,9 +395,17 @@ checkdot(char **argv) { char *p, **save, **t; int complained; + struct stat sb, root; + stat("/", &root); complained = 0; for (t = argv; *t;) { + if (lstat(*t, &sb) == 0 && + memcmp(&root, &sb, sizeof(struct stat)) == 0) { + if (!complained++) + warnx("\"/\" may not be removed"); + goto skip; + } /* strip trailing slashes */ p = strrchr(*t, '\0'); while (--p > *t && *p == '/') @@ -412,6 +420,7 @@ checkdot(char **argv) if (ISDOT(p)) { if (!complained++) warnx("\".\" and \"..\" may not be removed"); +skip: eval = 1; for (save = t; (t[0] = t[1]) != NULL; ++t) continue;