What Happens if You Really Delete Your Root Directory?

Today I remove my root directory! On purpose!
👇 PULL IT DOWN FOR THE GOOD STUFF 👇
Patreon - / thelinuxcast
Liberapay - liberapay.com/...
KZbin - / @thelinuxcast
===== Follow us 🐧🐧 ======
Odysee - odysee.com/$/i...
Mastadon - @[e-mail]
/ thelinuxcast
/ mtwb
Discord - / discord
gitlab.com/the...
Subscribe at thelinuxcast.org
Contact us [e-mail]
Telegram Group - t.me/+9lYoIuLh...
Amazon Wishlist - www.amazon.com...
Merch Store - zaney.creator-...
Logo Courtesy of - pedropaulo.net
==== Referenced ====
rm rf / -- Don't do this command
===== Thanks to Our Patrons! ====
Tier 5 Patrons
Syd A.
Tier 4 Patrons
Devon, Patrick
Tier 3 Patrons
Marcus, Maeglin, Jackson Knife and Tool, Steve A, CyberGuyLinux, Garrick
Tier 2 Patrons
Mitchel, Archsinner, carnondated, Shaun, Jeremy, Odin, Martin, Andy P.
Tier 1 Patrons
Marek, Camp514, Joshua Lee, Joris AKA JDawg, Peter, Crucible, Darkbadits6, Vlad A, Primus
#dontdothis #linux #thelinuxcast

[@gustavomariz7769]

they should change the "--no-preserve-root" to "--i-want-to-kill-my-system" so no one uses it without knowing what it does lol

[@Psy500]

I can't think of any scenario where you would. If you really wanted to nuke a root directory (like you are repurposing a system drive) you'd reboot in another volume as / where the old / is mounted as something else to avoid the risk of nuking everything.

[@_thresh_]

Like what if a newbie doesn't know what root is and thinks it's a nonessential file?

[@MrLeoStief]

I appreciate how you keep demonstrating insane things so we don't have to try them ourselves. Like deleting your root directory or using Gnome.

[@devhypercoder2522]

You got me in the first part. To try this yourself use a vm - don't know how to test gnome tho without destroying your sanity

[@a_maxed_out_handle_of_30_chars]

good one dude

[@deltadoobyd1621]

I did it to my main machine before, because I wanted to install another OS. Had a USB plugged in and it got wiped. Luckily, I had a backup.

[@chrisMuc1966]

03:46 R.I.P - Rest in Pieces.

[@phonewithoutquestion80]

Yeah I've used aliases to make the rm command safer, always prompt-first with '-i' so you have to actually double check.

[@PaulaBean]

'rm' is a synonym for 'unlink'. Unlink only removes directory entries, the files themselves still exist and opened files can still be used because they're addressed by inode. Of course, when a program has to be loaded it can't be found anymore. There are processes that dynamically load libraries; those libraries will be gone too and these processes will fail, so probably your system will crash after some time or some interactions.

[@lawrencespicher1769]

Rm in bash is short for remove aka delete

[@tanyuanzheng797]

​@@lawrencespicher1769What do you think happens when you delete a file? The OS doesn't actually "delete" the file; how Linux works (and most OSes for the matter, with variations on details and implementation) is that it stores chunks of the file in blocks, which blocks contain what files are kept track of using a data structure called the Inode. So what happens when you delete a file? You're basically telling the OS that the blocks containing the file that you just deleted can be used/written to again. This is why deleting files are so fast: you are only changing a few entries in the group descriptor, and not overwriting like a few MB or even GBs of data.

[@hhdhpublic]

No mistake. Had a laptop where I needed to reinstall the os so I wanted to see what happened. The system broke. Lol.

[@zoltan1953]

This video makes a really good case for breaking the habit of overusing sudo. I still have a really bad habit of using sudo because when I first got into Linux, all of the commands I looked up and everything that I asked for help with had me use sudo. I'll never do this, but I do need to get into the habit of only using sudo when I need to.

[@nerdycatgamer]

I just try every command without sudo (even the ones i find online) and then if it gets mad at me i try again with sudo

[@mattschwartzstein3159]

Appreciate the effort! I've always wondered. Basically happened the way I expected tho.

[@alexevier]

when someone says something that has something to do with destroying linux i always say "sudo rm -rf /" as a joke, i think its a bit funny (sorry for my bad english lol)

[@Kwales66]

I did it once accidentally About 35 years ago on a Unix mainframe. Never again.

[@chrisMuc1966]

07:44 1.) Throw your computer out of the window 2.) Buy a new computer 3.) Reinstall everything

[@Baburun-Sama]

In Windows: deltree %systemroot%

[@electric7487]

Does deltree even exist anymore?

[@gwgux]

I've only ever done this for demonstration purposes when teaching someone the Linux command line and for my own knowledge back when I was first learning back in the early 2000s on a test machine (no fail safes back then either, it just did it). I wonder how long that fail safe has been there. I usually do the 'rm -rf /*' form when showing them what not to do and I don't remember seeing that prompt before. It's been a long while since I've done it though. At least a few years and I don't remember if it was an Ubuntu based system or not. Sometimes I've even recommended to people to create some aliases for their shell (for their account and for the root account) for things like emptying out the current directory so they avoid typing 'rm -rf /*' instead of 'rm -rf ./*' depending on how they are entering their commands. Basically build in some protection for yourself against...yourself. Nowadays with the fail safes, it's not needed as much, but everyone is different and will take their mistakes to what ever extreme they will take them if they aren't thinking about what they're doing. Also, yes, you're correct about things being in memory. What happens is when the system goes and executes the binaries to bring up your X session or shell, those things are copied to RAM from storage and executed from RAM (as we all know). Deleting the files under them doesn't take them out of RAM so they're still running. What causes them to crash is when they go to reference their files again and there no longer there. The results are pretty similar if you do this from a standard TTY without X running (typical of a server install). The shell is still running (it never left RAM), but all the commands like ls, cp, rm, etc. for basic system functionality are gone so basically you can only just keep hitting enter on the shell and pretty much all commands will have the usual "command not found" message from the shell. Depending on time, I've also booted the VM from a live ISO so I could mount the drive on it and show them the damage that was done to the system as a result of running that command. Internet trolls aside, this is something everyone should do at least once in a dummy VM with no valuable data in it so you're not going to harm any of your actual data. Simply for experiencing it yourself and then maybe even boot a live ISO and mound the drive and see for yourself what was left behind and what actually happened. Including any mount points the dummy VM had so you can see for yourself what happens even with multiple drives and partitioning (you should already know what to expect, but seeing it reinforces it). Experiencing how things break for yourself when something like this happens is a good way to learn what to look for when you jump on a system one day and see it's very broken like this. This also allows you to think about and try next steps like booting the failed from a live ISO to see what files you can save and/or do some data recovery on it before just reinstalling. In most day-to-day stuff on our Linux systems it's extremely rare for us to see a catastrophic system issue like this (in 20 years, the closest I've seen to this is failed hardware), but practicing handling broken systems like this in a safe test environment (usually on a VM these days) is pretty important since things do eventually break and it'll be far easier to know how to troubleshoot issues if you've experienced them.

[@jarlfenrir]

3:28 according to my linux experience - it doesn't matter, put the flag anywhere, just keep one space before and after

[@UKprl]

/proc and /sys aren't directories populated on disk, (they are empty mount points for metaphors created by the system at runtime) so there aren't any files to delete but I imagine based on your experience that you remembered this later after uploading.

[@tassaron]

Stuff like /proc, /sys, and /dev can't be deleted because they aren't true files, they represent aspects of a Unix system. The --no-preserve-root option is useful for Bash scripts that may have an empty variable, e.g., RM -rf /$dirname

[@autonaut279]

lol no idea why but the cursor Made me laugh 🤣

[@jneal4154]

I did this once while trying to delete the PWD on a remote server... --no-preserve-root definitely isn't on every distro.😬 It was a very bad day... My session just closed instantly and the hosting company was incapable of restoring the server to a workable condition and we had to migrate to an entirely fresh host.

[@jneal4154]

I once accidentally recursively chmod'd the root directory using sudo find -f, too... You get to keep all your files, but feels somehow even more devastating. Lol

[@electric7487]

sudo find /* -type f -exec shred -ufz {} \;

[@PankosmiosAlithia]

This made me lol ! Your facial expression in the warning disclaimer made my day - thank you for sharing this :)

[@PankosmiosAlithia]

That alone was enough to subscribe!

[@phrtao]

It's not as much as dragging and dropping Windows directories. I used to work with a guy who did that to people who pissed him off just before he left their offices. No one ever worked out what he had done or why. It just took a second before he powered off the machine.

[@TitleTheTitle]

when three letter fellas break into your den you gotta be quick typing that

[@tankermottind]

In that case, wouldn't you be better off typing sudo dd if=/dev/zero of=/dev/sda to frustrate attempts to reconstruct the data?

[@glidersuzuki5572]

rm -rf / Permission denied Adds sudo *Panikk*

[@bjorn7696]

Aren't the trolls saying to use it with /* these days? I haven't tried it, but it should be a workaround for the failsave mechanism.

[@TheLinuxCast]

I don't know, honestly.

[@JoeProstko]

@@TheLinuxCast Yes, "rm -rf /*" will work the same as just "rm -rf / --no-preserve-root" due to shell expansion.

[@fecklesstech929]

I've always wanted to try this. Perfect video!

[@glidersuzuki5572]

I think there was things in memory that kept displaying but changing any location in the memory pointed to complete nothing or invalid stuff.

[@MrCradleman]

I did it several times when I return corporate laptop back. I open tty as root user and change permissions for root recursively, because even for root user some folder read only, but if you change permissions you will be able to wipe everything

[@michaelnolan1715]

sudo bash is a root prompt sets user to root unless thats just based on the uid of the process or something, sudo as setuid bit set (so sudo runs as user that is the owner of the sudo binary) so you could set it up for any app to launch as root from any user (you need root access to set the setuid bit on the file)

[@tutacat]

Using sudo (super user do / switch user do) does run as uid 0, actually as root, but some things cannot be "deleted" (unlinked) such as read only filesystems (snap), or if they have the immutable attribute; and parts of memory, such as /sys, /proc. You can't "delete" a process like that because the virtual filesystem doesn't support it. But running through su would not change that. The devpts virtual filesystem does support deleting the inodes/device files, and is stores in memory, so any files saved in it will use up memory. But you can make device nodes manually too.

[@gl0sek]

Well I did something like this. I had small ssd and the space was running out since I was doing lots of backups with timeshift. I thought that maybe timeshift had just left some garbage behind. I found some timeshift files in /usr/share. I don't know what I did wrong but after that that rm command my system crashed. It was my old test laptop so nothing important was lost but from that day I check 10x before I delete things outside home directory.

[@ManiBalajiC]

I did similar to do this but force removed dependencies tree for a app , it depended on lot of system level Libraries too, it automatically logged off and became corrupted

[@drishalballaney]

if you use "/*" instead it would also delete efi, plus all the other disks attached to it, plus in some cases also the complete BIOS thus rendering the system completely unbootable

[@ivanreyes9873]

Never heard of bios being deleted...

[@arch-chan]

What? The BIOS? That's not in your disk, how come it deletes the BIOS?

[@ees4.]

@@arch-chantheoretically, if efi is mounted. That is generally only something that happens on windows though.

[@bedwar12494]

@@ees4. no, it wouldn't remove the uefi/bios (i know this from testing on hardware ;] ) edit: this may only be in my case because i have seen some comments saying that their bios got deleted and they had to reflash it

[@electric7487]

@@bedwar12494 ​ @TheEesaKhokhar It's worth noting that, for a brief period in 2016 with SystemD and UEFI, "rm -rf /" or "rm -rf /*" with --no-preserve-root could actually permanently hard-brick your machine since the EFI configuration variables, located at /sys/firmware/efi/efivars, were mounted as read/write.

[@_lun4r_]

now what happens if you dd if=/dev/urandom of=/dev/sda bs=4M status=progress ?

[@sinitsyn2000]

I did it once on physical hardware just for lolz It made my used laptop that I got for like $20 not boot at all. Like it was not even reacting to power button, no fans, no nothing. Turns out, this command might delete the bios system, and if a motherboard manufacturer did not care about self-restoration after such operation (creating isolated storage on motherboard, for example) - then you need to reflash your bios with hardware flashing device (idk how is it called in english sry) So in my opinion it might be even more dangerous than people think, as it potentially can completely brick your device

[@sinitsyn2000]

​@Terminalforlife (LL) it was not just "rm --no-preserve-root -rf /", it was "rm --no-preserve-root -rf /*" i've seen people in the comments there reporting the same behavior. Also, it was back in 2018 on a 2013 laptop. I was using manjaro. idk what happened exactly as well

[@electric7487]

This actually happened in 2016 with UEFI machines that ran SystemD. For whatever reason, SystemD decided to mount the EFI firmware's configuration variables as read/write instead of read-only, and if you ran «rm -rf /» with elevated privileges you would delete those variables, permanently hard-bricking the machine. Though, well-designed firmware should be able to recover from this and throw an error such as "No bootable device found" instead of being completely immobilised.

[@njo-]

the most fit linux user

[@BytebroUK]

Probably been done below, so forgive me, but I believe Linux|*nix does reference counting on file handles, so if you 'delete' you are actually 'unlinking'. The file only goes away once the count of active 'handles' or 'links' drops to zero.

[@chrisMuc1966]

04:48 This is the Linux black hole.

[@retrobuild4614]

even if you delete with /bin/bash, what happens?

[@JusticeForQ]

u can delete it all by installing a chroot into /usr/share and then deleteing the entire directory that the chroot is in. doesnt even require sudo

[@sto3359]

I did it once... Never again.

[@klotinxng5714]

I deleted my root directory accidentally with rm -rf and got stuck on my working environment. Wow, so really there ain't a way to restore?

[@TheLinuxCast]

Not unless you have a backup or a snapshot, nope. If you don't have a backup, you'll need to reinstall and have it be lesson learned.

[@electric7487]

Nope. Restore your data from a backup and then reinstall.

[@chadwinters4285]

Guess what? I am on btrfs file system and I mistakenly deleted my root filesystem. How come it was by mistake? I delete a snapshot of the system that is the actual system itself. Guess what? Even though my root directory was completely empty, I was able to boot into the system as if noting happened. I don't know why, but thought I should mention it. Maybe others with more knowledge of btrfs can chime in.

[@markmilan57]

Hey buddy do you know how to increase the /dev/loop0 on pen drive bootable Linux coz mine one got full and nothing working expects few commands....

[@TheLinuxCast]

I do not. Ask Ubuntu or a similar forum may be able to help.

[@abdulararak4672]

I'm suprised that you never done this before. The warning appears also on Arch so I think it don't depend of distro.

[@abdulararak4672]

For me it was one of first things that I did when I started to learn VMs. I also tried removing system32 on Windows.

[@TheLinuxCast]

I never thought to try, really. Not something I think most people thing to try.

[@movielifelives]

I used this sudo rm -rf / --no-preserve-root and i can't see any drives on the boot menu help me please first I have windows 10 and then used linux mint and used this command in linux mint and that's it now boot menu not showing any drives

[@syed758]

Bro I did the same..did you recover any of it?

[@Xnoob545]

It deletes everything plugged into your system, including any extra drives lol The files should be recoverable by sepcialized software but your system is GONE You can reinstall a new system tho

[@Artichoked1]

try it on a host os and see if you can brick the computer

[@bedwar12494]

i know this is really late, but if you want to troll people better, you'd tell them to sudo rm -rf /* because it doesn't trigger the failsafe and you don't have to specify --no-preserve-root

[@alexismarie2652]

This was fun. What else can we break?

[@electric7487]

sudo chmod 777 -R / There you go, expose your system to everyone with just one click.

[@33v4.]

watching this is both scary and fun!!

[@fellowcontentconsumer9713]

what if you delete system32 of linux

[@matyasmarkkovacs8336]

There's no System32 in Linux.

[@ABOhiccups]

2:38 This is incorrect command line. “/“ is not doing anything unless you add “--no-preserve-root” as you already shown in your video. The correct command line used by trolls as a meme is. sudo rm -rf /* The “*” is a wildcard which means anything. So if you enter “sude rm -rf /*” in the Terminal. It will tell Linux to remove everything inside the Root Directory.

[@root_dnb]

If you run this command it will make your Linux install run faster, sudo dd if=/dev/urandom of=/dev/sda bs=1M status=progress

[@ees4.]

This is worse than rm -rf -no-preserve-root.

[@bedwar12494]

jokes on you i use a nvme drive

[@linux-guy9596]

Sudo rm -rf 'homework' Better 😂

[@kyrone0001]

Just minutes ago, I did rm -rf on lib bins lib64 media.... on my company server.... -1 player on server Earth :< I least I still have home folder and maybe reinstalling the ubuntu asap

[@DinoLopez]

Let me suggest a slightly different use case, where u dont have to delete but change permissions on the / partition, only accessible by root. 0600. It will continue working for root, but nobody else. =)

[@electric7487]

Or, destroy all file security on your system by letting anyone do anything they want: sudo chmod 777 -R /*

[@lightningmcqueen2674]

they should change the "--no-preserve-root" to "--i-want-to-kill-my-self" . Thanks for the demo . You are hilarious. Thanks for talking us [frustrated people] down when having a bad day ;)

[@twickk]

I accidentally did this. 😔

[@sarbagyanepal9787]

ok

[@neuxze]

0:18 im my case im using a vm and i just want to :p

[@mastergamer4335]

If you do sudo rm -rf /* the star is gonna force it to happen.

[@ipoop4359]

No the f will force it the star will remove everything

[@mastergamer4335]

@@ipoop4359 nope the r stand for recyrse and the f stand for folder. And a star usually means a wildcard for everything but here it is like both. I can upload a video on it and send you.

[@ipoop4359]

@@mastergamer4335 f doesnt stand for folder lmao😹