[SOLVED] rc.local_shutdown not working!

Ne36u12Y · 02-03-2015, 02:58 PM

Hello fellow Slackers

In setting up Slackware 14.1 64bit I used this:

Quote:

/usr/bin/find /tmp -mindepth 1 -maxdepth 1 -print0 | xargs -0r /bin/rm -rf

found at: http://www.slackword.net/?p=78

entering it into vim and naming it rc.local_shutdown, and placing in /etc/rc.d/
making it:

Quote:

/etc/rc.d/rc.local_shutdown

and then making it executable:

Quote:

chmod +x /etc/rc.d/rc.local_shutdown

And presto this little script emptied my /tmp directory!

However, recently, it stopped working.
I checked this rc.local_shutdown script and this is what I found:

Quote:

/usr/bin/find /tmp -mindepth 2 -maxdepth 1 -print0 | xargs -0r /bin/rm -rf

The "-mindepth 1" changed to "-mindepth 2" ???

So, my /tmp folder would not empty! I changed the "2" back to a "1" and back to normal!

How could this have happened? To change this would not one have to have root rights/access???
I have a paranoid feeling my system was compromised???

Doing some searching on:

http://docs.slackware.com/howtos:gen...ree_your_space

I found this:

Quote:

/usr/bin/find/ /tmp -mindepth 1 -maxdepth 1 -exec /bin/rm -rf {} +;

Using vim I edited the script using this new line of instruction, and everything is working again, just as it did with the previous line of instruction, as it should.
I am not sure, but I do not think this could have happened updating the system using slackpkg?

So two main questions:

(1). How did/could this of happened?

And;

(2). What is the difference between these three lines of instruction:

Quote:

/usr/bin/find /tmp -mindepth 2 -maxdepth 1 -print0 | xargs -0r /bin/rm -rf

And;

Quote:

/usr/bin/find /tmp -mindepth 1 -maxdepth 1 -print0 | xargs -0r /bin/rm -rf

And;

Quote:

/usr/bin/find/ /tmp -mindepth 1 -maxdepth 1 -exec /bin/rm -rf {} +;

Any help on this would be greatly appreciated.
Please explain like I am a 10 year old.

Thanks for your time and efforts.

P.S. I searched for anything similar on LQ's but to no avail.

j_v · 02-03-2015, 03:55 PM

I can't say what's happening, but I would be curious what an inotifywatch on the file would turn up.

Code:

# inotifywatch -v -e modify /etc/rc.d/rc.local

If you did a full install, the inotify-tools package will be available. There are other interesting and useful options. You could leave out the -e modify and it would watch for all events listed in the manpage. Or, you could have multiple events to watch for:

Code:

# inotifywatch -v -e modify -e open -e close_write -e attrib /etc/rc.d/rc.local

If you are missing inotify-tools, it is easy to install it using slackpkg, the installation media, or even downloading from official slackware mirror then installing with installpkg. If you need help with any of these, having read the man pages and installation help, don't hesitate to ask.

j_v · 02-03-2015, 04:03 PM

The -mindepth 2 option to find means that only files that are in subdirectories of the command line arguments will be processed.

Ne36u12Y · 02-03-2015, 04:19 PM

Wow thanks J_V for the fast reply and easy explanation!

I still can't see why it would change from a "1" to a "2"??? From the efforts of your second post (thanks by the way),
the "-minddepth 2" option would clean out sub-directories of the directories in the /tmp directory, with the command line arguments held in this:

/usr/bin/find /tmp -mindepth 2 -maxdepth 1 -print0 | xargs -0r /bin/rm -rf

Is that correct?

I will give "inotifywatch" a go: looks brilliant.

Thanks

j_v · 02-03-2015, 04:32 PM

As far as the second question, the main difference is the -mindepth options. The second and third lines of the second question are (to the best of my understanding of find and xargs) simply two forms to achieve the same thing; I've seen various security issues mentioned for using both the -exec find option as well as piping the output of find to xargs to do processing on files found. The find man page explains about the security risks involved in using 'find ... -exec' and about using the -execdir option instead. See the find info page, in the 'Security Considerations' node, for more thorough handling of the subject.

Ne36u12Y · 02-03-2015, 04:39 PM

Thanks very much J_V, excellent efforts in help, explanations and directions! Appreciate you taking the time.
Have a great day!

Richard Cranium · 02-03-2015, 07:15 PM

Depending upon how much RAM you have, you could mount /tmp on a tmpfs...

Code:

rc@darkstar:~$ grep /tmp /etc/fstab
/dev/mdgroup/tmplv      /var/tmp            xfs         defaults  1   2
tmpfs                   /tmp                tmpfs       defaults  0   0

That way, /tmp is cleaned out by a reboot automatically. If there are temporary files that should survive reboot, you put them in /var/tmp

(This doesn't solve your problem with the rc.local_shutdown script and how it somehow mutated; it just shows another way to have /tmp cleaned out at reboot.)

Ne36u12Y · 02-03-2015, 07:36 PM

Thanks for your input Richard Cranium, your offer with another method is interesting.

Yes the mutation of the code: -mindepth 1 to -mindepth 2 without me changing it with vim, is a puzzle!

perbh · 02-03-2015, 10:26 PM

Code:

/usr/bin/find /tmp -mindepth 2 -maxdepth 1 -print0 | xargs -Or /bin/rm -rf

I can't see that it will rm any files at all, seeing you use 'O' (letter oh) as an argument to xargs rather than '0' (digit zero), irrespective of of mindepth being 1 or 2

a4z · 02-04-2015, 01:05 AM

what is the different between

Code:

/usr/bin/find /tmp -mindepth 1 -maxdepth 1 -print0 | xargs -Or /bin/rm -rf

and

Code:

/bin/rm -rf /tmp/*

?

Poprocks · 02-04-2015, 06:51 AM

Occam's Razor: the simplest explanation is usually the right one.

My gut feeling is that you changed it somehow maybe using a malformed sed command or maybe you just never entered the script the way you said you did, and you just think you did.

rg3 · 02-04-2015, 12:26 PM

Quote:

Originally Posted by perbh

Code:

/usr/bin/find /tmp -mindepth 2 -maxdepth 1 -print0 | xargs -Or /bin/rm -rf

I can't see that it will rm any files at all, seeing you use 'O' (letter oh) as an argument to xargs rather than '0' (digit zero), irrespective of of mindepth being 1 or 2

Apart from that above, if you use vim to edit these files there's a common mistake I make in vim from time to time: when being near a number, the combination Ctrl+A increases that number. I usually make that mistake if I think I'm inside a screen session when using vim, and I'm not.

rg3 · 02-04-2015, 12:27 PM

Quote:

Originally Posted by a4z

what is the different between

Code:

/usr/bin/find /tmp -mindepth 1 -maxdepth 1 -print0 | xargs -Or /bin/rm -rf

and

Code:

/bin/rm -rf /tmp/*

?

The second command doesn't erase hidden directories and files.

TracyTiger · 02-04-2015, 01:19 PM

Quote:

Originally Posted by rg3

Apart from that above, if you use vim to edit these files there's a common mistake I make in vim from time to time: when being near a number, the combination Ctrl+A increases that number. I usually make that mistake if I think I'm inside a screen session when using vim, and I'm not.

Thanks for bringing up the Ctrl-A vim function. As just a basic and fumble fingered vim user this is good for me to know and watch out for.

I can relate to your situation. For me, it's when I use a GUI editor I end up with :w, dd and such peppered throughout the document.

Ne36u12Y · 02-04-2015, 03:35 PM

Quote:

Originally Posted by perbh

Code:

/usr/bin/find /tmp -mindepth 2 -maxdepth 1 -print0 | xargs -Or /bin/rm -rf

I can't see that it will rm any files at all, seeing you use 'O' (letter oh) as an argument to xargs rather than '0' (digit zero), irrespective of of mindepth being 1 or 2

perbh is quite correct!

Thanks for your input perbh!