I think this is a more reliable way of detecting rm -rf /. Previous effort was
reverted due to false positives.
Index: rm.c
===================================================================
RCS file: /cvs/src/bin/rm/rm.c,v
retrieving revision 1.36
diff -u -p -r1.36 rm.c
--- rm.c 1 Feb 2016 22:34:19 -0000 1.36
+++ rm.c 15 Apr 2016 17:59:35 -0000
@@ -395,9 +395,17 @@ checkdot(char **argv)
{
char *p, **save, **t;
int complained;
+ struct stat sb, root;
+ stat("/", &root);
complained = 0;
for (t = argv; *t;) {
+ if (lstat(*t, &sb) == 0 &&
+ memcmp(&root, &sb, sizeof(struct stat)) == 0) {
+ if (!complained++)
+ warnx("\"/\" may not be removed");
+ goto skip;
+ }
/* strip trailing slashes */
p = strrchr(*t, '\0');
while (--p > *t && *p == '/')
@@ -412,6 +420,7 @@ checkdot(char **argv)
if (ISDOT(p)) {
if (!complained++)
warnx("\".\" and \"..\" may not be removed");
+skip:
eval = 1;
for (save = t; (t[0] = t[1]) != NULL; ++t)
continue;
