【事故】复现--CentOS7 执行 rm -f /*

在近期工作中由于新同事一时疏忽执行了 rm -f /* （当时新人已经慌了）
作为一名老司机并没有被该命令吓到，三下五除二搞定
接下来来还原一下从执行命令到恢复的过程：

系统环境如下：

[root@Docker-01 ~]# cat /etc/redhat-release 
CentOS Linux release 7.6.1810 (Core) 
[root@Docker-01 ~]# uname -a
Linux Docker-01 3.10.0-957.el7.x86_64 #1 SMP Thu Nov 8 23:39:32 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux

根下的文件如图：

执行 rm -f /*后（目录并没有被删除），但已无法执行 ls 、ll、scp、rz、ssh等命令

执行ls命令后是什么样子呢？ 如下

[root@Docker-01 /]# ls
-bash: /usr/bin/ls: /lib64/ld-linux-x86-64.so.2: bad ELF interpreter: No such file or directory

找台没问题的CentOS7 查看下 这个文件是什么 /lib64/ld-linux-x86-64.so

[root@Docker-02 ~]# cd /lib64
[root@Docker-02 lib64]# ll ld-linux-x86-64.so.2 
lrwxrwxrwx. 1 root root 10 May 28 13:08 ld-linux-x86-64.so.2 -> ld-2.17.so

好吧 这个文件竟然也是个链接文件，那就看看 这个 ld-2.17.so 是什么来头

[root@Docker-01 lib64]# ll ld-2.17.so 
-rwxr-xr-x. 1 root root 163400 Oct 30  2018 ld-2.17.so

竟然是个可执行文件，执行下看看能不能执行

 [root@Docker-01 /]# /usr/lib64/ld-2.17.so 
Usage: ld.so [OPTION]... EXECUTABLE-FILE [ARGS-FOR-PROGRAM...]
You have invoked `ld.so‘, the helper program for shared library executables.
This program usually lives in the file `/lib/ld.so‘, and special directives
in executable files using ELF shared libraries tell the system‘s program
loader to load the helper program from this file.  This helper program loads
the shared libraries needed by the program executable, prepares the program
to run, and runs it.  You may invoke this helper program directly from the
command line to load and run an ELF executable file; this is like executing
that file itself, but always uses this helper program from the file you
specified, instead of the helper program file specified in the executable
file you run.  This is mostly of use for maintainers to test new versions
of this helper program; chances are you did not intend to run this program.

  --list                list all dependencies and how they are resolved
  --verify              verify that given object really is a dynamically linked
            object we can handle
  --inhibit-cache       Do not use /etc/ld.so.cache
  --library-path PATH   use given PATH instead of content of the environment
            variable LD_LIBRARY_PATH
  --inhibit-rpath LIST  ignore RUNPATH and RPATH information in object names
            in LIST
  --audit LIST          use objects named in LIST as auditors

竟然可以执行
这个文件是干什么用的呢？在linux公社看到相关的博文，如下

既然是库文件的管理程序，那就试试吧
在故障机上执行 /usr/lib64/ld-2.17.so --library-path /usr/lib64/ /usr/bin/ln -s /usr/lib64 /lib64
(此时须指定/usr/lib64/ 作为默认库，随后将 /usr/lib64 链接到 /lib64)
执行 ll 命令，奇迹发生了 可以使用了

随后对比下正常服务器的根目录下的链接还有哪些，链接上

[root@Docker-01 ~]# ln -s /usr/bin/ /bin
[root@Docker-01 ~]# ln -s /usr/sbin/ /sbin
[root@Docker-01 ~]# ln -s /usr/lib /lib

恢复后如下图：

至此已经恢复完成了

参考博文：
https://www.linuxidc.com/Linux/2017-01/139826.htm
http://www.xuyanlinux.com/archives/142 （这里还有救援模式的解决方法）

【事故】复现--CentOS7 执行 rm -f /*

原文：https://blog.51cto.com/rhelanker/2411995