I think this is a more reliable way of detecting rm -rf /. Previous effort was
reverted due to false positives.

Index: rm.c
===================================================================
RCS file: /cvs/src/bin/rm/rm.c,v
retrieving revision 1.36
diff -u -p -r1.36 rm.c
--- rm.c        1 Feb 2016 22:34:19 -0000       1.36
+++ rm.c        15 Apr 2016 17:59:35 -0000
@@ -395,9 +395,17 @@ checkdot(char **argv)
 {
        char *p, **save, **t;
        int complained;
+       struct stat sb, root;
 
+       stat("/", &root);
        complained = 0;
        for (t = argv; *t;) {
+               if (lstat(*t, &sb) == 0 &&
+                   memcmp(&root, &sb, sizeof(struct stat)) == 0) {
+                       if (!complained++)
+                               warnx("\"/\" may not be removed");
+                       goto skip;
+               }
                /* strip trailing slashes */
                p = strrchr(*t, '\0');
                while (--p > *t && *p == '/')
@@ -412,6 +420,7 @@ checkdot(char **argv)
                if (ISDOT(p)) {
                        if (!complained++)
                                warnx("\".\" and \"..\" may not be removed");
+skip:
                        eval = 1;
                        for (save = t; (t[0] = t[1]) != NULL; ++t)
                                continue;

Reply via email to