[GTALUG] How much do you know about how linux executes binaries?

[Lennart Sorensen]

On Wed, Dec 11, 2019 at 07:12:57PM -0500, D. Hugh Redelmeier via talk wrote:
> "/*" matched every name in / (not dotfiles)
> 
> The last name matched was /var.  We know this because of the list that
> Lennart gave us later -- we might have had to figure this out
> ourselves.
> 
> Ignoring the clashing names and /var, everything that was in / was
> moved to /var.
> 
> Clearly some fundamental tools are impaired.
> 
> The first reason (but not the only one) is that /bin has been moved to
> /var/bin (but we may not realize this right away).
> 
> Note: usually echo is built into the shell so
> 	echo *
> would work as a substitute for
> 	ls

Yes echo * is very important.

> | So what do you do now?
> 
> Take a break to calm down.  Anything you do in a panic is likely to
> make things worse.

Rebooting would have made it a lot harder for sure.  Fortunately the
guy came and asked me for help instead.

> Make a plan.  Before you take any step that might be irreversible.
> Exploring is OK.
> 
> It's true that this is an interesting problem.  But getting tricky
> when confronted with an emergency isn't always wise.

Well it was only his test system, but it would have been annoying to
have to recreate it.

> I would probably boot from a live system on a USB stick, mount /
> somewhere, and look around.  Fixing things from such a system is
> actually simpler than trying to do so from the busted system.  You
> don't need a deep understanding of the mechanisms for run-time
> linking.  You won't need to get the dynamic linker and libraries back
> onstream.

I am not actually sure that particular system can even boot from USB,
and it has serial console only, no VGA.

> A clean shutdown will be a challenge but it probably doesn't matter.
> After booting the live system, do an fsck on the original system's /
> to make up for a bad shutdown.
> 
> That's really nice to know.  In many scenarios you would not know
> this.

That's for sure.

> - this lets you figure out where everything went without any detective
>   work (/var)
> 
> - this lets you figure out what must be moved back.

-- 
Len Sorensen