Editing Rm (Unix) (section)

== Safety ==

=== Permissions ===
On most file systems, removing a file requires write and execute permissions on the containing directory. Some may be confused that permissions on the file to be removed are irrelevant. However, the GNU implementation confirms removing a write-protected file unless the -f option is used.<ref>{{Cite news|url=https://www.theinquirer.net/inquirer/news/2454743/man-destroys-his-entire-company-with-a-five-character-bash-command|archive-url=https://web.archive.org/web/20160416214235/http://www.theinquirer.net/inquirer/news/2454743/man-destroys-his-entire-company-with-a-five-character-bash-command|url-status=unfit|archive-date=April 16, 2016|title=Linux rm command help and examples|date=24 January 2018|work=ComputerHope|access-date=24 January 2019}}</ref>

To remove a directory (using <code>-r</code>), its contents must be removed, recursively. This requires the user to have read, write and execute permissions to the directory (if it's not empty) and any non-empty subdirectories recursively. Read permission is needed to list the contents of the directory. This sometimes leads to an odd situation where a non-empty directory cannot be removed because the user doesn't have write permission to it and so cannot remove its contents, but if the same directory were empty, the user would be able to remove it.<ref>{{Cite news|url=https://www.macworld.com/article/2082021/master-the-command-line-deleting-files-and-folders.html|title=Master the command line: Deleting files and folders|last=McElhearn|first=Kirk|date=2 January 2014|work=Macworld|access-date=24 January 2019}}</ref>

If a file resides in a directory with the [[sticky bit]] set, then removing the file requires the user to own the file.

=== Preventing accidental deletion ===
Commands like <code>rm -rf *</code> are relatively risky since they can delete many files in an unrecoverable way. Such commands are sometimes referenced in anecdotes about disastrous mistakes,<ref name="Linux/UNIX: Delete a file">{{cite web|last=Gite|first=Vivek|title=Linux/UNIX: Delete a file|url=http://www.cyberciti.biz/faq/howto-linux-unix-delete-remove-file/|publisher=Nixcraft|access-date=24 November 2011}}</ref> such as during the production of the film ''[[Toy Story 2]]''.<ref name="Panzarino">{{cite web |last1=Panzarino |first1=Matthew |title=How Toy Story 2 Got Deleted Twice, Once on Accident, Again on purpose |url=https://thenextweb.com/news/how-pixars-toy-story-2-was-deleted-twice-once-by-technology-and-again-for-its-own-good |website=TNW {{!}} Media |access-date=27 September 2022 |language=en |date=21 May 2012}}</ref> 

To minimize the risk of accidental file deletions, a common technique is to hide the default {{code|rm}} command behind an alias or a function that includes the interactive option. For example:

<syntaxhighlight lang="bash">
alias rm="rm -i"
</syntaxhighlight>

or

<syntaxhighlight lang="bash">
rm () { /bin/rm -i "$@" ; }
</syntaxhighlight>

Then, by default, {{code|rm}} requires the user to confirm removing each file by pressing {{key|Y}} or {{key|N}} plus {{key|Return}}. To bypass confirmation, a user can include the <code>-f</code> option (as the option specified later on the expanded command line "<code>rm -i -f</code>" takes precedence). 

Unfortunately this can lead to other accidental removals since it trains users to be careless about the wildcards they hand to <code>rm</code>, as well as encouraging a tendency to mindlessly press {{key|Y}} and {{key|Return}} to confirm.{{Citation needed|date=July 2012}} Users have even been seen going as far as using <code>yes | rm ''files''</code>, which automatically confirms the deletion of each file. {{Citation needed|date=July 2012}}

A compromise that allows users to confirm just once, encourages proper wildcarding, and makes verification of the list  easier can be achieved with something like:

<syntaxhighlight lang="bash">
if [ -n "$PS1" ] ; then
  rm () 
  { 
      ls -FCsd "$@"
      echo 'remove[ny]? ' | tr -d '\012' ; read
      if [ "_$REPLY" = "_y" ]; then
          /bin/rm -rf "$@"
      else
          echo '(cancelled)'
      fi
  }
fi
</syntaxhighlight>

Arguably, this function should not be made into a [[shell script]], which would run a risk of it being found ahead of the system <code>rm</code> in the search path, nor should it be allowed in non-interactive shells where it could break batch jobs. Enclosing the definition in the <code>if [ -n "$PS1" ] ; then ....  ; fi</code> construct protects against the latter.

Other commands are designed to prevent accidental deletion; including {{code|safe-rm}}<ref>{{Cite web|url=https://launchpad.net/safe-rm/+index|title=Safe-rm in Launchpad|website=Launchpad}}</ref> and {{code|trash}}.<ref>{{Cite web|url=https://github.com/andreafrancia/trash-cli|title=andreafrancia/trash-cli|date=September 12, 2020|via=GitHub}}</ref>

=== Protection of the filesystem root ===

The <code>rm -rf /</code> command, if run by a [[superuser]], causes every file of the file system to be deleted. For safety, [[Sun Microsystems]] introduced special protection for this command in [[Solaris (operating system)|Solaris]] 10 (first released in 2005). The implementation reports that removing {{code|/}} is not allowed.<ref>{{Cite web|url=https://blogs.oracle.com/jbeck/date/20041001%23rm_rf_protection|archive-url=https://web.archive.org/web/20161103124127/https://blogs.oracle.com/jbeck/date/20041001|archive-date=2016-11-03|url-status=dead|title=Meddling in the Affairs of Wizards}}</ref> Shortly thereafter, the same functionality was introduced into the [[FreeBSD]] implementation.<ref>{{Cite web|url=https://github.com/freebsd/freebsd/commit/d6b7bd90c2776d9ccd8bb7f33a899bd213aebf85|title=The previous commit added code to rm(1) to warn about and remove any · freebsd/freebsd@d6b7bd9|website=GitHub}}</ref> The [[GNU]] version refuses to execute <code>rm -rf /</code> unless the <code>--preserve-root</code> option is included,<ref>{{Cite web|url=https://www.gnu.org/software/coreutils/manual/html_node/rm-invocation.html|title=rm invocation (GNU Coreutils)|website=www.gnu.org}}</ref> which has been the default since version 6.4 of [[GNU Core Utilities]]. In newer systems, this [[Fail-safe|failsafe]] is always active, even without the option. To run the command, user must bypass the failsafe by adding the option <code>--no-preserve-root</code>, even if they are the superuser.