Yesterday I deleted /etc by mistake.

I remembered I found a software to prevent this kind of things but I can't find it anymore. I don't remember the name and actually Google is not helping.

It had a configuration file with a list of files/directories of critical files and the program was checking against that list everytime a user was issuing the rm command.

Does anybody know it?

  • I know. I should have thought longer before running the command. – Daniele Sep 23 '10 at 12:15
  • I don't want it to happen again. I just need something that when anybody try to run 'rm /etc' or 'rm /var' it will not let them – Daniele Sep 23 '10 at 12:16
  • are you saying you wont learn your lesson?? – Nick Kavadias Sep 23 '10 at 12:31

the /etc directory should only be writeable by root. If its not, then there's something wrong with your setup.

And on a non-MAC Unix / POSIX / Linux system root is god. Most people who use such systems do so because they like to be in control of their systems - but "with great power comes great responsibility".

Don't use root access unless your sure you know what you're doing.


alias rm to rm -i in your /etc/profile for system wide or just the .bash_profile in your home directory for just your account.

add this:

alias rm='rm -i'

you may find that many distro's do this by default. i.e. Redhat

another more simple way to prevent this is setup a normal user account for normal user account things. You should not be doing things like surfing the web with root.

  • 1
    That's a baaaaaad idea. If you form the habit that rm will protect you, when the alias is missing for whatever reason - BAM! It would be better to alias another name to rm -i. – Dennis Williamson Sep 23 '10 at 15:07

To ext2/3/4 easy:

chattr +i /etc/
  • chattr is a command in the Linux operating system that allows a user to set certain attributes on a file residing on an ext2-based filesystem
  • +i is to set the immutable bit to prevent even root from erasing or changing the contents of a file
  • Except this can cause temporary confusion when you actually have to change configurations and it doesn't work... – Bart Silverstrim Sep 23 '10 at 12:04
  • But bear in mind that this is going to cause all sorts of problems when you next try to apply patches! – symcbean Sep 23 '10 at 12:04
  • Yes, I don't think it is a good idea for /etc. – Daniele Sep 23 '10 at 12:12

As mentioned before, there is rm -i.

alias rm='rm -i'

But, much better, is the the -I option, because it doesn't get in your way that often.

-I     prompt once before removing more than three files, or when removing 
       recursively. Less intrusive than -i, while still giving protection 
       against most mistakes

additionally, I'd suggest --preserve-root (if it is not yet the default on your system):

alias rm='rm -I --preserve-root'

Set the permissions of the folder to "Access Files" rather than "Create and Delete files" for Others, the Group, or Owner; depending on your environment. I recommend using the Principle of Least privilege. Make a user or group that can only access files to certain folder, then set to log in to that user by default. If you need special privileges, just elevate from terminal.


In the long run I'd advise what most other admins do...learn not to do it again, keep good backups, and don't run as a user that automatically has rights to delete key directories with a keystroke, but rather use Sudo so you have a slight pause before hitting . Workarounds tend to cause some confusion down the road unless it's completely documented or they cause additional behaviors that are not welcome (like figuring out why you can't alter config files without additional commands)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy