Slashdot Mirror
Steam For Linux Bug Wipes Out All of a User's Files
An anonymous reader sends a report of a bug in Steam's Linux client that will accidentally wipe all of a user's files if they move their Steam folder. According to the bug report:
I launched steam. It did not launch, it offered to let me browse, and still could not find it when I pointed to the new location. Steam crashed. I restarted it. It re-installed itself and everything looked great. Until I looked and saw that steam had apparently deleted everything owned by my user recursively from the root directory. Including my 3tb external drive I back everything up to that was mounted under /media.
Another user reported a similar problem — losing his home directory — and problems with the script were found: at some point, the Steam script sets $STEAMROOT as the directory containing all Steam's data, then runs rm -rf "$STEAMROOT/"* later on. If Steam has been moved, $STEAMROOT returns as empty, resulting in rm -rf "/"* which causes the unexpected deletion.
I can hear the Steam dev. shop manager:
Carl! Put the bullhorn down! Dave! Quit staring at Lucy and get back to wark! Kevin! We have to ship this code in TWO DAYS! Jerry! Don't point that over here!
Is why you have backups. You need to apply the rule Total Backups = Total Backups -1 so if you have 1 you have 0.
Screw over people on Windows with micro-transactions and useless updates, screw over people on Mac with games that run poorly, screw over people on Linux by wiping files. It's like, the less popular your OS of choice, the more shafting you get.
Attention user, Steam has detected unusual activity on your part that could be construed as part of an effort to hack Steam. Therefore, Steam has deployed the Doomsday Device on your machine. You now have 5 minutes to either comply with out request to restore Steam to its original folder or to send a bionic person to shut down the Doomsday Device at the source. Otherwise, your system will be wiped and FBI agents will be arriving at your home shortly. Please keep your hands in the yellow circles pending their arrival. And thank you for using Steam!
SJW's don't eliminate discrimination. They just expropriate it for themselves.
Wow! That is all.
OTOH, running it on an SeLinux system would probably contain the damage.
Best Slashdot Co
Okay children, I'm going to teach you this command explicitly so that you know what you never, ever, EVER - wake up little Johnny - what was I saying? Oh yeah, ever, ever use it.
Seriously. Don't use it.
Loading...
You don't even need to check $STEAMROOT, I mean what could possibly go wrong... /* is how a Windows developer would write the command to delete a directory if they simply looked up the equivalent command for Linux.
But still for extra points the script should have asked to run as root...
And a little advice to Valve, next time have developers familiar with Linux working on your Linux client. That
Violence is the last refuge of the incompetent. Polar Scope Align for iOS
Apple had a bug like that in the iTunes installer sometime back that did exactly that: a rm -rf from root as root. Theirs came from if you had a space in your hard drive name.
They need to have system administrators working for them, apparently. Not using that command is so ingrained, that I have the nightmare where I type "rm -rf /" in a console instead of the dream where you are naked in front of the class, or the one where you didn't study for finals.
I also have the one where I run the endless loop of opening more and more xterms until my SPARCstation falls over.
Something like this might have helped:
if [ "$STEAMROOT" != "" -a "$STEAMROOT" != "/" ] ...do your evil deletion of $STEAMROOT here
then
if [ -d "$STEAMROOT" ]
then
fi
fi
Should avoid at least a full deletion traversal of the filestore, but it's still got a risk that $STEAMROOT might be ~username (or /tmp, which is less critical).
They just left out the ampersand.
Easy fix.
deleting the extra space after periods so i can stay relevant, yeah.
yet as a proprietary application expects in this case to invoke the GPL mantra of usability without warranty
If you think the GPL invented that mantra, you must be smoking the good stuff. All (normal COTS) software comes with the "we take as little legal responsibility as at all possible" and it's because of crackpot legal systems like the US. Be glad that you can just throw software out there, otherwise writing software would be high liability sport only for those with deep pockets or nothing to lose.
Live today, because you never know what tomorrow brings
you mean the Linux that your friendly, neighborhood, NSA so graciously helped secure?
I would figure that --no-preserve-root would be required to delete root directory?
Remember back in the day when the Sierra uninstall utility could accidentally delete all your files? I think that was a result if you put it in a non-standard location, too.
They need to have system administrators working for them, apparently. Not using that command is so ingrained, that I have the nightmare where I type "rm -rf /" in a console instead of the dream where you are naked in front of the class, or the one where you didn't study for finals.
I also have the one where I run the endless loop of opening more and more xterms until my SPARCstation falls over.
Your classroom fail wasn't a dream. People are still talking about it.
A few years ago, Inuit released an online update to Quickbooks for Mac that effed your entire partition. I happened to be away on a business trip when this happened and I had to have my backup drive FedExed to me. Did Intuit offer to pay for that? Hell no. Did anyone file a class action suit? Who knows, but even if they did, I'd have gotten discounts for coupons for cellphone cases or something equally useless.
I could have sworn that that mantra appeared in BSD licenses well before the GPL was a twinkle in RMS' eye. Yep.
If I cared to research it, I'm certain I would find similar language in proprietary licenses which predate even that.
Your distinction between "on" and "for" is equally myopic and artificial. Binaries "for" an operating system is used so commonly it is only questioned by ideological zealots, which most of us are not.
Not using that command is so ingrained, that I have the nightmare where I type "rm -rf /" in a console instead of the dream where you are naked in front of the class, or the one where you didn't study for finals.
You could also do what I did once, and accidentally hit space in the command and not notice.
rm -rf a/bunch/of/local/junk /
Except that's not quite right. What I actually did was:
sudo rm -rf /usr/local/dontremember /bin
You are in a maze of twisty little relative jumps, all alike.
From the rm(1) man page on most Linux distros:
--no-preserve-root do not treat '/' specially (the default)
--preserve-root
fail to operate recursively on '/'
Why --preserve-root isn't the default is beyond me, since it would be generally faster to re-create the filesystem if that's what you _really_ wanted.
I had a similar situation in a product I was working on once where it was a PHP script with an undefined variable. It was the exactly same result: rm -rf /
Fortunately a QA guy caused it while testing. It was hell to figure out what happened because it was running as room and had wiped the entire system.
Exception handling. No exceptions. Now go.
Aside from areas where it's legally unavoidable(medical devices, avionics, probably some nuclear applications), applications that take the slightest responsibility for their actions are virtually unheard of, under any license. On a good day, a proprietary application might accept liability up to the value of a refund; but not further, if it fucks up really egregiously; but that's about the extent of it.
You can get software that promises more; but it will cost you mightily.
> steam had apparently deleted everything owned by my user recursively from the root directory. Including my 3tb external drive I back everything up to that was mounted under /media.
All together now: This is why we disconnect our backup drive when we're not backing up the system!
Oliver's law of assumed responsibility: If you're seen fixing it, you will be blamed for breaking it.
...the year of linux on the desktop.
This reminds me of a game from something like 10 years ago that would delete everything from Program Files if you uninstalled it. I can't remember which one that was.
Gamingmuseum.com: Give your 3D accelerator a rest.
rm -rf .*
The key fact is that .. matches .*
Steam is manythings including spyware, malware, and even a rootkit.
[Citation Needed]
Which has more power: the hammer, or the anvil?
This is why you should have
set -o nounset
set -o errexit
at the top of every bash script. Also no one should be allowed to write a bash script unless they have read http://www.davidpashley.com/ar...
Rule #1, don't run as room. Room contains all the stuff.
This is the classic 2 year old mine mine mine mentality. Surely the user would not have ANYTHING other than our software on any system. There is no point in any software other than ours. THIS is why people hate overbearing companies like M$ and rottenapple.
So Valve, are you A) evil or B) criminally incompetent?
When TF2 has critical bugs that are still in it after 7 years and issues like the Strange PDA Engie Upgrade Bug that has been in the product for over a year, it amazes me that these guys are still going.
It just looks like they are running by the skin of their teeth since there are FREQUENT issues that are dangerous as hell or that stay in the product for ages.
Every new release of TF2 seems to add new bugs and they spend more time putting in new hats than fixing outstanding issues. This reeks of shitty software development.
- Zav - Imagine a Beowulf cluster of insensitive clods...
This seems like a common issue in Linux, particularly for people using it as a desktop environment. What would be the preferred method to limit access? Dedicated user/group with filesystem perms, cgroups, ACLs, chrooting, security modules (AppArmor/SELinux)?
MouseClass extends ScrollClass, which extends TabClass, which extends SidebarClass, which extends PowerClass, w
"set -o nounset" at the top of your bash script. Then bash acts a bit more like a real programming language, and gives an error if a variable is not set. More tips (and by 'tip' i mean pretty much essential knowledge) at http://www.davidpashley.com/ar...
Is there a way to mount a disk in a "Add only no delete" mode? If not, why not?
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
I bet someone is going through the blame diff's hoping they don't see their name... (2:03 https://www.youtube.com/watch?...)
Yeah, you might not want to tell people that story. If the hard drive was empty afterwards, your PHP was running as root... sure hope that PHP wasn't being run from the web server.
$ man rm
Where's "rm --preserve-root" when you need it?
I had a problem with th OS X version of steam. Client updates failed when placing the program in a different folder than applications.
while ((c = ...
...
{
}
/* INSERT THIS */
if( x.interactive == RMI_NEVER && x.ignore_missing_files == true && x.recursive == true ) {
char *mayi = getenv("RM_ALLOWRF");
if(mayi && strcmp(mayi,"YES")) {
printf("rm -rf allowed\n");
} else {
printf("rm -rf not allowed (set RM_ALOWRF=YES to enable)\n");
exit(EXIT_FAILURE);
}
}
/* END INSERT */
if (argc <= optind)
{
...
John_Chalisque
GAME OVER
Android enhancements have been merged into Linux kernel, and it had solution to this problem for years. Time to support sandboxing in userland of mainstream Linux distributions. Then Steam can reset its own data all it wants, but can not harm the rest of the system. Nobody is taking away your freedom to give appropriate permissions to system administration tools, but you don't usually want games to administer your system.
I'm a long time system engineer. I use that command in scripts fairly often. It's not necessarily ingrained to not use it, just to use it with extreme care, which didn't happen in this case.
And that's one reason I don't like the structure of *nix file systems.
One false move and you can erase everything you have plugged into your system, including, but not limited to, all your hard drives, external hard drives, network mounts, memory cards, USB sticks etc.
Sure, there's a good chance you can recover the lost data, but rebuilding a file system on one disk is painful enough, let alone all of your disks plus your NAS and it's even worse if just some of the files had their records deleted. At least in my experience.
People are not wearing enough hats.
That tends to be too restricted for things to actually run, alas. For example, something in a chroot can't even see libc or use standard Unix utilities on its own files, because /lib and /bin are outside of the chroot. You end up having to install a whole second copy of Linux inside the chroot...
10 PRINT CHR$(205.5+RND(1)); : GOTO 10
Steam is manythings including spyware, malware, and even a rootkit.
[Citation Needed]
It's really not true. Steam is not a rootkit.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
The Windows installer has a similar issue and apparently it is not even considered as a problem (red box):
https://support.steampowered.c...
This reeks of serious incompetence or negligence, in my opinion - writing installers that blindly mass-erase files instead of tracking which files did the software actually install and erase only those on uninstall/move is not acceptable in my book. Whether or not it is documented in some disclaimer that nobody reads or not is irrelevant. This really is asking for a lawsuit if someone gets seriously bitten by it.
I really wonder what the devs at Valve were smoking when they consider this as acceptable.
Bourne sh, POSIX sh, and bash globbing all suck because, while handy in very simple situations, they are not REs, not very versatile/capable, and not very intuitive. It's not that you CAN'T DO what you need to do; it's that you have to approach the problem uniquely.
To match via globbing any file or directory starting with one or more dots, but exclude dot and dot-dot standalone pseudo-links, I believe the most efficient recourse is the somewhat perverse: .[^.]* ..?*
ls -d1
which is quite an indictment of obstinate design stupidity. REs are better, but still a minefield. The best I can come with using REs are:
ls -a | grep '^\..*[^.][^.]*$'
and the slightly more concise
ls -a | egrep '^\.+[^.]+$'
I will leave it as an exercise to ponder why you need the -d but not the -a in the first form, but must use the -a and NOT the -d in the last two forms. It's pretty disgusting when you work out EXACTLY how those options work. The -1 is not necessary in the second two cases because the pipeline magically changes the output format.
Wasn't this almost same thing talked about in UNIX hater's handbook almost two decades ago? Why this is still an issue? Especially in a software like Steam?
And yet some people still cling on to shell scripts for their boot system.
yo dawg, I heard you liked linux, so we are putting linux in yo linux!....
have you seen my sig? there are many others like it but none that are the same
wait... someone had the bright idea of having an application (a game, no less!) overwrite a vital system file??
That is just fucking insane if I read that correctly.
Political debates have me rolling my eyes so much I think I got optical whiplash. I should sue. - Foamy The Squirrel
From what I understand, this is how Android works. Every app gets its own user and group.
It is also, sort of, how Docker works. Each app gets its own container, the app is completely bound to that container. Docker manages access to outside resources (like the network) for you, utilizing cgroups, and kernelspace drivers.
Somebody didn't have their coffee that morning XD Hahahaha
That's the eternal problem though. The balance between power necessary and acceptable user/program hindrance.
OMG facts!
I don't trust Steam, so I run it in an unprivileged linux container. This way, it can't do too much damage and can't spy on my system so easily.
Setting up LXC in such a way that games still work is not trivial, but also not terribly difficult if you know your way around the OS and are willing to do some reading and learning. Here are some tips to get you started.
Bourne sh, POSIX sh, and bash globbing all suck because, while handy in very simple situations, they are not REs, not very versatile/capable, and not very intuitive. It's not that you CAN'T DO what you need to do; it's that you have to approach the problem uniquely.
To match via globbing any file or directory starting with one or more dots, but exclude dot and dot-dot standalone pseudo-links, I believe the most efficient recourse is the somewhat perverse: .[^.]* ..?*
ls -d1
Is this example supposed to be Bourne sh, POSIX sh, or bash globbing? Bourne sh is rather weakly defined, it is not POSIX, and who cares for bash...
The description of basic regular expression bracket expressions in the Base Definitions volume of IEEE Std 1003.1-2001, Section 9.3.5, RE Bracket Expression shall also apply to the pattern bracket expression, except that the exclamation mark character ( '!' ) shall replace the circumflex character ( '^' ) in its role in a "non-matching list" in the regular expression notation. A bracket expression starting with an unquoted circumflex character produces unspecified results.
Moreover, ls -d1 .[!.]* ..?* will probably give you ls: ..?*: No such file or directory and a non-zero exit status. And if you get .]: Event not found., you accidentally put it into a csh.
And if you use for FILE in * .[!.]* ..?*, you cannot simply disregard [ "$FILE" = "..?*" ], because there can be a file with that name.
I had more examples of great shell programming here, but could not get them through the junk character filter.
Now, is this correct and portable?
for FILE in * .[!.]* ..?* ; do [ "x$FILE" = "x*" -o "x$FILE" = "x.[!.]*" -o "x$FILE" = "x..?*" ] && [ ! -e "$FILE" ] && continue ; echo "$FILE" ; done
I am not sure. That is the true beauty of shell programming.
People do that: virtualisation.
In a sense it indicates that the OS has failed...
I was hoping someone would mention Android.
Just a pity Android doesn't let you do anything meaningful with that well-designed permissions infrastructure...
For instance, you either trust an app with your entire contacts-list, or your contacts-list is out-of-bounds entirely. There no way to 'Add contact to app', and have that launch a trusted contact-selector utility.
What? preserving root is default. From rm man page: --no-preserve-root do not treat `/' specially --preserve-root do not remove `/' (default) So, is this a "generalization" that it did "rm / -Rf" ? I can't imagine a world they would specify the non-default flag of --no-preserve-root. Seems BS to me.
A very similar bug happened in one of Bungie's software (back when they made mac games) where an uninstall would delete more than just the game files. In response, they reissued new CDs and it was a massive cost to do so. This required they take out a loan and sell some stock, which ultimately resulted in Microsoft being able to buy them latter on.
The code was not malicious, It was incompetent. It is the difference between venomous and poisonous. Snake fangs are venomous, designed to kill. Arsenic is poisonous, it kills but not designed to.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
It's why I really prefer
rm [path] -rf
Linux allows this, but the last BSD I used required me to put the arguments before the path
rm -rf [path]
Why is this bad? Well, if accidentally tap enter or something akin to that while partway through typing a path, say goodbye to anything that's along the way!
Or you could hardlink to the originals before you call the chroot program (*facepalm*) ... ofc for that you need root permissions and it does not work on *all* unixes.
Cost free eBook I read (by iBook/Kobo/Amazon/ObookO/Gutenberg etc.): "The Green Odyssey" by Philip Jose Farmer.
That is a different permission system to the one under discussion.
You don't even have to typo. There's a nasty bug in Konsole where if you're typing under load, it will get characters out of order. So rm -rf /var/tmp/x /var/tmp/y becomes rm -rf /var /tmp/x/var/tmp/y (or something like that). That was fun to recover from.
I noticed long ago that the typical EULA guaranteed that the media would remain media for 90 days, and put severe restrictions on what I could do with any software I happened to find on it.
"When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
ls -a | grep '^\..*[^.][^.]*$'
Misses files such as .a.b.
ls -a | egrep '^\.+[^.]+$'
Misses files such as .a.b. and .a.b.
Try the following instead:
ls -a | egrep '^\.([^.]|\..)' (a string starting with a dot, then either a non-dot or a dot followed by any character)
There was a Solaris patch that did the equivalent of rm -rf /. I couldn't find a link, but I may have read about it on the RISKS Digest.
The better system is called capabilities. Think "everything is a file descriptor". You want to create a file, you get a file descriptor. You want to run most programs, you give them read-write scratch space, a place to find common library routines (that don't carry any rights by themselves), and probably a read-write access to some graphical interface window. You're a browser, your user clicks on a java applet? You download the applet into a descriptor from your scratch space, you run it, giving it a read-write descriptor to some user interface sub-window created from your own window, read-write to a descriptor of some scratch space created from you scratch space, and read-execute of some descriptor containing a library, probably the same one you got from your parent. You have a video with a proprietary codec? You run the proprietary program as above with read-only to the video. You're a word processor? You get a RW descriptor to the file you're editing, and a call-back to your parent if your user requests an "open file" dialog, which returns a RW (or maybe RO) descriptor to the file the user indicated. See a pattern? See KeyKOS, which actually worked for years, and followers EROS, CapROS, Coyotos, which none got to to any useful status. There was a guy who rewrote libc on these principles, IIUC so that you'd only have to change file-handling logic in classical programs and recompile. But I get the impression that most people working on these things are security and OS researchers in academia (sincerely sorry if someone feels insulted, I'm not helping out and if you weren't working on it I wouldn't even know about these things), and not people saying OK, I have a generous budget, I have excellent developers and excellent team leads and stellar project managers, now I want a timeline and then a product.
For other non-OS projects see Plash, Capsicum, Tahoe-LAFS, E-Lang, CapDesk...
It does install a service on Windows that runs with elevated privileges, allowing Steam to do admin-y stuff at will, though. Not a rootkit because it isn't hidden and doesn't resist removal, but still sketchy. I disable this service; it means I have to put up with a UAC prompt on the rare occasion I need to run a Steam game for the first time, but I'm OK with that.
I haven't tried it on Linux, yet. Due to the DRM nature of Steam, I avoid buying from them. The DRM-free games from Humble Bundle and GOG work fine on Linux without requiring that I install Valve's crap.
There's no place I could be, since I've found Serenity...
..but since '/' is owned by root (isn't it?) and isn't writeable by the user in question (presumably) then shouldn't the "rm -rf /*" stop at root and proceed no further? That would seem sensible to me.
I mean, I know that's not now it works (obviously, since the problem occurred) - but why?
If you were using coreutils in your nightmare, you would actually have no problem: / /*, however.
(guys, don't do this at home, your rm implementation could differ)
# rm -rf
rm: it is dangerous to operate recursively on '/'
rm: use --no-preserve-root to override this failsafe
# rm --version
rm (GNU coreutils) 8.23
You wouldn't enjoy such protection if you typed rm -rf
CCP's EVE Online once accidentally erased user's boot.ini file during a major patch.. http://community.eveonline.com... They survived, and there is even a commemorative item in-game in remembrance of the event. I think Steam will work this out, too. Any word on how many were affected?
You mean that it's a UI issue, rather than an issue of support existing in the OS?
This command erases every file in every directory which your username is allowed write permissions. That's a lot of files.
I guess I'll be setting up separate users for my gaming versus other usecases of the computer.
Sadly, a Libertarian cannot force his views on another, and freedom cannot spread as does the cancer known as religion.
I could have sworn that that mantra appeared in BSD licenses well before the GPL was a twinkle in RMS' eye.
BSD license was 88, GPL 89. Hardly that far apart.
If you ignore ACs because they are anonymous - you're an idiot.
Not really. What you are talking about is capabilities provided by the Dalvik VM whereas what was being discussed was unix-style filesystem permissions.