Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question?
If it is not in the man pages or the how-to's this is the place! |
Notices |
Welcome to LinuxQuestions.org, a friendly and active Linux Community.
You are currently viewing LQ as a guest. By joining our community you will have the ability to post topics, receive our newsletter, use the advanced search, subscribe to threads and access many other special features. Registration is quick, simple and absolutely free. Join our community today!
Note that registered members see fewer ads, and ContentLink is completely disabled once you log in.
Are you new to LinuxQuestions.org? Visit the following links:
Site Howto |
Site FAQ |
Sitemap |
Register Now
If you have any problems with the registration process or your account login, please contact us. If you need to reset your password, click here.
Having a problem logging in? Please visit this page to clear all LQ-related cookies.
Get a virtual cloud desktop with the Linux distro that you want in less than five minutes with Shells! With over 10 pre-installed distros to choose from, the worry-free installation life is here! Whether you are a digital nomad or just looking for flexibility, Shells can put your Linux machine on the device that you want to use.
Exclusive for LQ members, get up to 45% off per month. Click here for more info.
|
 |
05-27-2012, 09:47 PM
|
#1
|
Member
Registered: Oct 2011
Location: Cardiff
Distribution: Debian 6.0.5
Posts: 39
Rep: 
|
Accidentally overwrote /bin/bash in Debian 6.0.5
I must remember never to sudo when tired.
Is there any way to recover from this without reinstalling?
I still have a terminal showing 'myuser@MYBOX:~$' running, is this file cached in any way?
Last edited by 313; 05-27-2012 at 10:07 PM.
|
|
|
Click here to see the post LQ members have rated as the most helpful post in this thread.
|
05-27-2012, 10:17 PM
|
#2
|
Senior Member
Registered: Jan 2012
Distribution: Slackware
Posts: 3,348
Rep: 
|
As you still have an open shell, the file is really unlinked, not deleted (yet).
I found an article describing how to recover an unlinked file via the file descriptor in /proc.
Edit: The article points out that you need the ID of the process using the unlinked file in order to find the file descriptor, but it fails to mention that a simple lsof | grep deleted will list all deleted files, with the process name and ID in the first and second columns respectively.
Last edited by Ser Olmy; 05-27-2012 at 10:31 PM.
|
|
2 members found this post helpful.
|
05-27-2012, 10:48 PM
|
#3
|
Member
Registered: Oct 2011
Location: Cardiff
Distribution: Debian 6.0.5
Posts: 39
Original Poster
Rep: 
|
Thanks for the response, that appears to be the right direction to be going in.
lsof +L1 shows bash as process 2666 and 3115 (I overwrote it twice, lol), although the corresponding folders in /proc don't seem to yield anything that looks like my /bin/bash file.
I've done a sudo cp /proc/3115/exe /tmp/testing per the instructions here (seemed easier to follow than the link you provided, no offense), but as I overwrote the file instead of deleting it, is this likely to have fixed it, and how can I be sure?
Inputting bash still gives the fail of a script I overwrote it with (so I could switch between sfw/nsfw wallpapers :P).
Also, so it's noted, there's no way I can get the box connected to the internet (on a seperate XP laptop ATM).
Last edited by 313; 05-27-2012 at 10:51 PM.
|
|
|
05-27-2012, 11:02 PM
|
#4
|
Senior Member
Registered: Jan 2012
Distribution: Slackware
Posts: 3,348
Rep: 
|
While I'm not about to delete /bin/bash on any of my systems just to see if this will work under such conditions, I did try
Code:
cat /proc/<id>/exe > testfile
...with <id> being the process ID of a login shell. A quick chmod u+x testfile, and I could start a new shell process with ./testfile.
Edit: Curiousity got the better of me, so I did try it, although I played it safe by using ksh as my victim rather than bash. And I backed up ksh first. I know, chicken.
I logged on at one console and ran ksh. I then ran the following commands at another console:
Code:
rm /bin/ksh
echo Random text > /bin/ksh
At this point ksh is gone, and the file /bin/ksh contains rubbish. I then ran ps ax | grep ksh to find the ID of the still-running ksh process (709 in my case). I then did this:
Code:
cat /proc/709/exe > /bin/ksh
chmod 755 /bin/ksh
ksh
And that resulted in a ksh prompt.
Last edited by Ser Olmy; 05-27-2012 at 11:18 PM.
|
|
1 members found this post helpful.
|
05-27-2012, 11:16 PM
|
#5
|
Member
Registered: Oct 2011
Location: Cardiff
Distribution: Debian 6.0.5
Posts: 39
Original Poster
Rep: 
|
Okay, it appears the only file with any size in the /proc directories is the 792.1kb exe file.
I've done a sudo cp /proc/3115/exe ~/ and renamed the file to bash, but I have no idea what the typical filesize of /bin/bash is, and Google shows no relevant results. At this point I need to confirm whether this is the correct file, or whether I'd simply be extending my being awake for another few hours (it's 4am now).
Could someone check the size of this file on their system, or confirm whether this is the correct one?
|
|
|
05-27-2012, 11:22 PM
|
#6
|
Senior Member
Registered: Jan 2012
Distribution: Slackware
Posts: 3,348
Rep: 
|
My /bin/bash file is 888kb (version 4.2.24(2)-release).
Does file identify it as an executable?
|
|
1 members found this post helpful.
|
05-27-2012, 11:22 PM
|
#7
|
Member
Registered: Oct 2011
Location: Cardiff
Distribution: Debian 6.0.5
Posts: 39
Original Poster
Rep: 
|
AWESOME, it looks like it's worked, thanks for your help. Positively identified it as an executable and took the plunge by copying it to /bin/bash (what did I have to lose, after all).
I only lost 3 hours of my life and a perfectly good pr0n wallpaper script (which'll probably take up at least another half hour), but at least my system is alive. I did a GUI-less Debian install for the first time a few days ago, and to hell with seeking out endless niggling packages to fix severe and trivial issues alike all over again.
Last edited by 313; 05-27-2012 at 11:24 PM.
|
|
|
05-28-2012, 12:36 PM
|
#8
|
Bash Guru
Registered: Jun 2004
Location: Osaka, Japan
Distribution: Arch + Xfce
Posts: 6,852
|
All is solved before I show up, but to add my two cents anyway...
As long as you still have a working shell, why not just force a full reinstall of bash through apt?
Another option, if you needed to get into a working shell first, would be to grab a copy of the executable from somewhere, such as a live cd, and replacing the bad one.
You should probably then also again force an update to be sure you're using the most compatible version.
|
|
|
05-30-2012, 09:49 AM
|
#9
|
Member
Registered: Oct 2011
Location: Cardiff
Distribution: Debian 6.0.5
Posts: 39
Original Poster
Rep: 
|
Thanks for the response David, but I think I mentioned there was no way I could get the box connected to the internet, the ethernet cable was in a different room to the one where the box was plugged in.
I could've tried moving it, but it'd would've meant losing my working shell so it would have been quite useless I think (I remember trying to login from tty1 was impossible).
Also, from what I've read, copying the file from the live CD wouldn't have been as easy as it sounded (although maybe this would be easier/harder with Debian rather than Ubuntu).
|
|
|
All times are GMT -5. The time now is 11:19 PM.
|
LinuxQuestions.org is looking for people interested in writing
Editorials, Articles, Reviews, and more. If you'd like to contribute
content, let us know.
|
Latest Threads
LQ News
|
|