Moved ~/.local/share/steam. Ran steam. It deleted everything owned by user • Hacker News Board

Re: Moved ~/.local/share/steam. Ran steam. It deleted everything owned by user

#271

Post by deeviant » Sat, Jan 17, 2015, 12:59 AM UTC

akamaka wrote: post #3

Here's the offending shell script code: # figure out the absolute path to the script being run a bit # non-obvious, the ${0%/*} pulls the path out of $0, cd's into the # specified directory, then uses $PWD to figure out where that # directory lives - and all this in a subshell, so we don't affect # $PWD STEAMROOT="$(cd "${0%/*}" && echo $PWD)" [...] # Scary! rm -rf "$STEAMROOT/"* The programmer knew the danger and di…

I worked at a solar SCADA company that rolled there own APT packages.

In the pre and post install deb package scripts there was all kinds of crazy shit, like upgrading grub to grub 2 and manually messing with boot sectors. All this stuff in packages innocuously named modbus_driver.deb or what have you, and all in absolutely the most archaic bash syntax possible.

Eventually somebody mixed a rm -rf /bin/* with rm -rf / bin/*, and the rest is history. They bricked about 100 embedded PC's, all in remote locations, all powering powerplant SCADA systems that did stuff like connect to CalISO for grid management or collect billing information. It cost hundreds of thousand of dollars to fix.

Re: Moved ~/.local/share/steam. Ran steam. It deleted everything owned by user

#272

Post by SolarNet » Sat, Jan 17, 2015, 1:00 AM UTC

Arnavion wrote: post #123

SolarNet wrote: post #28

Earlier quoted context omitted.

There are, it's called users, and groups, and file permissions. Applications like steam should really be running under a separate user so they can't write to personal files (and maybe just have read permissions). But of course proper application isolation and file permissions is something few people do correctly on their personal machines, let alone know about. Window managers don't make it any easier, and I put a lo…

Steam shouldn't run as its own user. It's a user-level process, not a system process. It needs to have user-specific things (install directory, save games, etc.) that need to be accessible to the person using it. Separating processes into users is only one method of sandboxing, and not appropriate in this case. Sandboxing via mechanisms like SELinux is the correct solution. One of the users in the Github thread even…

Yes you are of course correct about SELinux!

I actually separated Steam into a sand-boxed "steam" user account. But maybe that's because I learned Unix on BSD and never included SELinux or how to use it (and it isn't obvious from a desktop user accounts perspective), I should probably check that out.

Re: Moved ~/.local/share/steam. Ran steam. It deleted everything owned by user

#273

Post by deeviant » Sat, Jan 17, 2015, 1:00 AM UTC

akamaka wrote: post #3

Here's the offending shell script code: # figure out the absolute path to the script being run a bit # non-obvious, the ${0%/*} pulls the path out of $0, cd's into the # specified directory, then uses $PWD to figure out where that # directory lives - and all this in a subshell, so we don't affect # $PWD STEAMROOT="$(cd "${0%/*}" && echo $PWD)" [...] # Scary! rm -rf "$STEAMROOT/"* The programmer knew the danger and di…

I worked at a solar SCADA company that rolled there own APT packages.

In the pre and post install deb package scripts there was all kinds of crazy shit, like upgrading grub to grub 2 and manually messing with boot sectors. All this stuff in packages innocuously named modbus_driver.deb or what have you, and all in absolutely the most archaic bash syntax possible. I did suggest, strongly to jail all application binarys that we twiddle around with, with something like chroot, but was rebuffed.

Eventually somebody mixed a rm -rf /bin/* with rm -rf / bin/*, and the rest is history. They bricked about 100 embedded PC's, all in remote locations, all powering powerplant SCADA systems that did stuff like connect to CalISO for grid management or collect billing information. It cost hundreds of thousand of dollars to fix.

Re: Moved ~/.local/share/steam. Ran steam. It deleted everything owned by user

#274

Post by mikeash » Sat, Jan 17, 2015, 1:53 AM UTC

kd0amg wrote: post #95

mikeash wrote: post #80

Earlier quoted context omitted.

How about using a better language? She'll scripting is an awful, awful language. An error like this wouldn't have happened if the program had been written in C or Python or Perl or whatever your choice might be. Shell scripting seems tremendously overused. It makes some things a bit easier, but it's so crazy it makes PHP a look like a pinnacle of good language design.

Using C or Python or Perl does not automatically keep people from failing to check whether some code that reaches out into the environment to prepare for later action actually succeeded.

I don't see any way to accidentally write code in C or Python (Perl may be a different beast as a sibling comment indicates) that deletes the user's home directory if an environment variable is unset. These languages don't keep you from failing to check, but they fail much better. An unset environment variable without a check means you'll probably crash, whereas with a shell script you just keep on going, with bad data.

Re: Moved ~/.local/share/steam. Ran steam. It deleted everything owned by user

#275

Post by 8_hours_ago » Sat, Jan 17, 2015, 2:55 AM UTC

colanderman wrote: post #115

8_hours_ago wrote: post #108

Earlier quoted context omitted.

Fyi: the -d option is specific to the BSD implementation of rm, it's not available in the GNU coreutils rm.

It's in my coreutils (8.22). Maybe it's recently added?

It looks like it was added in version 8.19. Probably about time to update my Ubuntu box...

http://savannah.gnu.org/forum/forum.php?forum_id=7342

Re: Moved ~/.local/share/steam. Ran steam. It deleted everything owned by user

#276

Post by cmurf » Sat, Jan 17, 2015, 4:02 AM UTC

Latty wrote: post #252

Chattered wrote: post #187

Earlier quoted context omitted.

But if that external usb drive is mounted at the time (as in the case of the user this thread is about), then all data on that drive will be deleted. For this reason, the recommened way to use things like rsnapshot is to have your backup directories owned by root and with permissions masked to something like rwxr--r--. If you then want to read your backups easily, you do things like mount it under NFS as read-only.

A (RAID6) fileserver running ZFS with filesystem-level snapshotting. It's really, really good.

Btrfs snapshots, and then cp --reflink from the snapshot to the current tree whatever files or directories are missing; i.e. no need to rollback to a snapshot.

Re: Moved ~/.local/share/steam. Ran steam. It deleted everything owned by user

#277

Post by DCoder » Sat, Jan 17, 2015, 12:59 PM UTC

pestaa wrote: post #213

zamalek wrote: post #182

Earlier quoted context omitted.

> I'd rather take the first option. At least my reputation will still be somewhat intact. I'd take the same option, but for different reasons: the customer's data. Only pictures of e.g. a deceased wife, no backup, and you just deleted them. You can arm-wave all you like about backing up, but you deleted them.

Dude, I am already stressed when hitting big red buttons in production, and from now on I can imagine the possibility of erasing unrecoverable memories about lost loved ones... This profession is tough on the most unexpected levels.

If you want more nightmare fuel (or just want to see various ways technology goes wrong), check out http://catless.ncl.ac.uk/Risks .

Re: Moved ~/.local/share/steam. Ran steam. It deleted everything owned by user

#278

Post by raldu » Sat, Jan 17, 2015, 8:11 PM UTC

rwallace wrote: post #222

Chris_Newton wrote: post #51

This seems like yet another good example of why robust application-level access control would be a helpful thing to build into modern operating systems, in addition to the typical user-based controls. This may have been both a rookie mistake and a regrettable failure of code review processes, but in any case it simply shouldn’t be possible for an application running on a modern system to wipe out all user data withou…

As a more immediate fix with less collateral damage, since Unix programmers refuse to stop putting `rm -rf` commands in shell scripts (they seem to think the suggestion is an insult to their manhood), change the behavior of rm so that by default it either disregards -rf or moves the target files to a trash directory where they can be retrieved in the event of an error.

A simple alias would work as a quick fix:

    alias rm='rm -I'

With the -I flag, rm asks the user before removing multiple files or removing recursively. One of the top in my aliases file.

Re: Moved ~/.local/share/steam. Ran steam. It deleted everything owned by user

#279

Post by wpietri » Mon, Jan 19, 2015, 6:34 AM UTC

bulatb wrote: post #184

wpietri wrote: post #135

Earlier quoted context omitted.

Yes, that person is still an unprofessional idiot. If a doctor accidentally removes the wrong organ because administrators have overscheduled him, "whoopsie, not my fault" is not the appropriate answer. The same applies to engineers working on bridges. Professionals take responsibility for their working conditions. There is an enormous shortage of programmers right now. Anybody shipping stuff that is bad or dangerous…

It's hard to be professional if no one wants or values it but you. The word your manager would use is "obstinate." If they have not internalized the consequences of the risks they're asking their subordinates to take, they'll weigh what look like vague misgivings about "mumble, should be better, dangerous, blah blah" against the better understood risk of their bonus disappearing if the product doesn't ship on time. E…

Sure, you can tell yourself that, and it will remain true. Or you can act like a professional and seek out places that value that. I have, and know others who do. I don't think we've sacrificed anything.

Re: Moved ~/.local/share/steam. Ran steam. It deleted everything owned by user

#280

Post by iopq » Tue, Jan 20, 2015, 2:13 AM UTC

rdc12 wrote: post #226

iopq wrote: post #16

Since this kind of thing keeps happening, isn't there a need for a safer tool than shell scripts? Maybe with a little bit more safety around null/empty variables and not as stringly typed?

Tools that are safer then shell scripts exist, doesn't mean that end users have them installed, doesn't mean people will chose to you them either

Python?