Newsgroups: comp.unix.admin
Path: utzoo!utgpu!news-server.csri.toronto.edu!rpi!zaphod.mps.ohio-state.edu!menudo.uh.edu!lobster!nuchat!buster!rli
From: rli@buster.stafford.tx.us (Buster Irby)
Subject: Re: Help - we lost all our files!
Message-ID: <1991Jun30.145153.27975@buster.stafford.tx.us>
Reply-To: rli@buster.stafford.tx.us
Organization: Buster irby
References: <1347@escob1.UUCP>
Date: Sun, 30 Jun 1991 14:51:53 GMT
Lines: 24

dickson@escob1.UUCP (Dave Dickson) writes:

>[ description of lost files deleted ]

>We are reasonably certain that this was not an intruder or other
>nefarious critter, as we have a reasonably secure system (I, know,
>famous last words).

>Anyway, any help or suggestions as to the cause of this would be
>appreciated.

>CRONTAB ENTRY:
>45 3 * * * find /tmp/* /usr/tmp/* -mtime +1 -print | xargs rm -r

The cause of the problem is that you executed this cron as root
and therefore it began processing from the root environment.  The
*BUG* then caused rm -r to be executed from '.' which equated to
'/'.  If you would take a more defensive posture and always cd to
one of the tmp directories, this could not have happened.

45 3 * * * cd /tmp; find /tmp/* /usr/tmp/* -mtime +1 -print | xargs rm -r

In this case, the worst that would have happened is it would have 
erased everything in /tmp.