LinuxQuestions.org
Visit Jeremy's Blog.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 05-27-2012, 09:47 PM   #1
313
Member
 
Registered: Oct 2011
Location: Cardiff
Distribution: Debian 6.0.5
Posts: 39

Rep: Reputation: Disabled
Accidentally overwrote /bin/bash in Debian 6.0.5


I must remember never to sudo when tired.

Is there any way to recover from this without reinstalling?

I still have a terminal showing 'myuser@MYBOX:~$' running, is this file cached in any way?

Last edited by 313; 05-27-2012 at 10:07 PM.
 
Click here to see the post LQ members have rated as the most helpful post in this thread.
Old 05-27-2012, 10:17 PM   #2
Ser Olmy
Senior Member
 
Registered: Jan 2012
Distribution: Slackware
Posts: 2,477

Rep: Reputation: Disabled
As you still have an open shell, the file is really unlinked, not deleted (yet).

I found an article describing how to recover an unlinked file via the file descriptor in /proc.

Edit: The article points out that you need the ID of the process using the unlinked file in order to find the file descriptor, but it fails to mention that a simple lsof | grep deleted will list all deleted files, with the process name and ID in the first and second columns respectively.

Last edited by Ser Olmy; 05-27-2012 at 10:31 PM.
 
2 members found this post helpful.
Old 05-27-2012, 10:48 PM   #3
313
Member
 
Registered: Oct 2011
Location: Cardiff
Distribution: Debian 6.0.5
Posts: 39

Original Poster
Rep: Reputation: Disabled
Thanks for the response, that appears to be the right direction to be going in.

lsof +L1 shows bash as process 2666 and 3115 (I overwrote it twice, lol), although the corresponding folders in /proc don't seem to yield anything that looks like my /bin/bash file.

I've done a sudo cp /proc/3115/exe /tmp/testing per the instructions here (seemed easier to follow than the link you provided, no offense), but as I overwrote the file instead of deleting it, is this likely to have fixed it, and how can I be sure?

Inputting bash still gives the fail of a script I overwrote it with (so I could switch between sfw/nsfw wallpapers :P).

Also, so it's noted, there's no way I can get the box connected to the internet (on a seperate XP laptop ATM).

Last edited by 313; 05-27-2012 at 10:51 PM.
 
Old 05-27-2012, 11:02 PM   #4
Ser Olmy
Senior Member
 
Registered: Jan 2012
Distribution: Slackware
Posts: 2,477

Rep: Reputation: Disabled
While I'm not about to delete /bin/bash on any of my systems just to see if this will work under such conditions, I did try
Code:
cat /proc/<id>/exe > testfile
...with <id> being the process ID of a login shell. A quick chmod u+x testfile, and I could start a new shell process with ./testfile.

Edit: Curiousity got the better of me, so I did try it, although I played it safe by using ksh as my victim rather than bash. And I backed up ksh first. I know, chicken.

I logged on at one console and ran ksh. I then ran the following commands at another console:
Code:
rm /bin/ksh
echo Random text > /bin/ksh
At this point ksh is gone, and the file /bin/ksh contains rubbish. I then ran ps ax | grep ksh to find the ID of the still-running ksh process (709 in my case). I then did this:
Code:
cat /proc/709/exe > /bin/ksh
chmod 755 /bin/ksh
ksh
And that resulted in a ksh prompt.

Last edited by Ser Olmy; 05-27-2012 at 11:18 PM.
 
1 members found this post helpful.
Old 05-27-2012, 11:16 PM   #5
313
Member
 
Registered: Oct 2011
Location: Cardiff
Distribution: Debian 6.0.5
Posts: 39

Original Poster
Rep: Reputation: Disabled
Okay, it appears the only file with any size in the /proc directories is the 792.1kb exe file.

I've done a sudo cp /proc/3115/exe ~/ and renamed the file to bash, but I have no idea what the typical filesize of /bin/bash is, and Google shows no relevant results. At this point I need to confirm whether this is the correct file, or whether I'd simply be extending my being awake for another few hours (it's 4am now).

Could someone check the size of this file on their system, or confirm whether this is the correct one?
 
Old 05-27-2012, 11:22 PM   #6
Ser Olmy
Senior Member
 
Registered: Jan 2012
Distribution: Slackware
Posts: 2,477

Rep: Reputation: Disabled
My /bin/bash file is 888kb (version 4.2.24(2)-release).

Does file identify it as an executable?
 
1 members found this post helpful.
Old 05-27-2012, 11:22 PM   #7
313
Member
 
Registered: Oct 2011
Location: Cardiff
Distribution: Debian 6.0.5
Posts: 39

Original Poster
Rep: Reputation: Disabled
AWESOME, it looks like it's worked, thanks for your help. Positively identified it as an executable and took the plunge by copying it to /bin/bash (what did I have to lose, after all).

I only lost 3 hours of my life and a perfectly good pr0n wallpaper script (which'll probably take up at least another half hour), but at least my system is alive. I did a GUI-less Debian install for the first time a few days ago, and to hell with seeking out endless niggling packages to fix severe and trivial issues alike all over again.

Last edited by 313; 05-27-2012 at 11:24 PM.
 
Old 05-28-2012, 12:36 PM   #8
David the H.
Bash Guru
 
Registered: Jun 2004
Location: Osaka, Japan
Distribution: Debian + kde 4 / 5
Posts: 6,837

Rep: Reputation: 1981Reputation: 1981Reputation: 1981Reputation: 1981Reputation: 1981Reputation: 1981Reputation: 1981Reputation: 1981Reputation: 1981Reputation: 1981Reputation: 1981
All is solved before I show up, but to add my two cents anyway...

As long as you still have a working shell, why not just force a full reinstall of bash through apt?

Another option, if you needed to get into a working shell first, would be to grab a copy of the executable from somewhere, such as a live cd, and replacing the bad one.

You should probably then also again force an update to be sure you're using the most compatible version.
 
Old 05-30-2012, 09:49 AM   #9
313
Member
 
Registered: Oct 2011
Location: Cardiff
Distribution: Debian 6.0.5
Posts: 39

Original Poster
Rep: Reputation: Disabled
Thanks for the response David, but I think I mentioned there was no way I could get the box connected to the internet, the ethernet cable was in a different room to the one where the box was plugged in.

I could've tried moving it, but it'd would've meant losing my working shell so it would have been quite useless I think (I remember trying to login from tty1 was impossible).

Also, from what I've read, copying the file from the live CD wouldn't have been as easy as it sounded (although maybe this would be easier/harder with Debian rather than Ubuntu).
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
[SOLVED] accidentally overwrote 1TB partition... any way to recover data? :( zuzoa Linux - Newbie 4 09-13-2009 01:59 PM
Setkeycodes error, accidentally overwrote 'up' Romanus81 Linux - Software 1 04-27-2008 08:39 PM
Accidentally overwrote /bin/sh roastedmnm SUSE / openSUSE 5 07-26-2005 03:37 AM
Accidentally overwrote MBR - Grub rrc124 Linux - Newbie 2 05-20-2005 01:24 AM
help: accidentally overwrote on crontab auden Slackware 1 02-14-2005 07:40 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie

All times are GMT -5. The time now is 12:31 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration