steam bug involving rm -fr /*

[nelsoncs]

Just wanted to give a heads up for linux users, the bug is still open and this could potentially be a big disaster:

 

http://www.theregister.co.uk/2015/01/17/scary_code_of_the_week_steam_cleans_linux_pcs/

 

and:

 

https://github.com/ValveSoftware/steam-for-linux/issues/3671

 

 

"...remove all files recursively, and without stopping, from the root directory down. Assuming the client is run as a normal user, it will delete everything owned by that account – including mounted backup drives and network shares – although leave other stuff, such as system files owned by root, intact."

 

Please see line #468 of .steam/steam.sh (at least that is the line # in my current version).

[gamedeviancy]

That is interesting, because I had mine set up that way before (with the symlink) and it worked fine. Although I kept the bulk of the Steam installation on the original drive. I had just moved the steamapps folder to another drive and sym linked it to the Steam installation folder.

 

There is also a setting within the Steam UI (Settings -> Downloads) to manage multiple game libraries across multiple drives. I wonder if that is safer.

[Guppy]

"Mistakes" ( and by that I mean sheer incompetence ) like this makes me wonder just what the hell they are teaching these days on universities.

[nelsoncs]

It looks like this is only going happen if you invoke the "reset_steam()" function in the script. So, definitely don't use the --reset commandline option, or try to move your steam directory and then symlink it at the old location (which is what the bug originator reported doing).

 

I myself have commented out the offending line and plan to check for my change being overwritten with each update. Don't know if this will actually serve as protection. But, if this causes a problem before this is patched, it seems better than risking my entire user dir being wiped.

[Ma-Shell]

I guess, chroot would be apropriate here? I don't really know much about it but as it allows you to limit the folders a program can see, it sounds like it could be of use here.

[DerRidda]

This has apparently been fixed already.

[Guppy]

This has apparently been fixed already.

 

source

[DerRidda]

Right here.

 

http://store.steampowered.com/news/15512/

 

You can check your steam.sh file to see if you have it already. The naughty line now checks if $STEAMROOT is empty.

 

# Check before removing
if [ "$STEAMROOT" != "" ]; then
rm -rf "$STEAMROOT/"*
fi

[Guppy]

Right here.

 

http://store.steampowered.com/news/15512/

 

You can check your steam.sh file to see if you have it already. The naughty line now checks if $STEAMROOT is empty.

 

# Check before removing
if [ "$STEAMROOT" != "" ]; then
rm -rf "$STEAMROOT/"*
fi

will still fail if $STEAMROOT is one of

• .. ( optionally with /.. added ad-nauseum )
  
• one or more spaces
  
• ~
  

and properly a host more

 

readlink -m $STEAMROOT

 

or realpath if available on the system side steps this issue by resolving the actual path first and then you can see if your someplace stupid like root, the root of your user dir ( ~ ) etc...

 

not sure how to alert value to the problem tho

[DerRidda]

Yeah, it absolutely is a "Valve Quality" fix. Not really great but still better than nothing, which was exactly what they did before.

The people on github are also decidedly unhappy with this solution.

https://github.com/ValveSoftware/steam-for-linux/issues/3671