---
title: rm Confirmation Guard
description: A small Bash function that wraps sudo and asks for confirmation before running rm, so a typo doesn't delete files owned by root.
---


:ellipsis{left=0px width=40rem top=10rem blur=140px zIndex=60}

`rm` doesn't ask twice. No recycle bin, no "are you sure", especially not with `sudo` in front of it, where a stray space or the wrong variable can wipe something you own no permission to double-check. It's the single most destructive habit a terminal builds into you, and the fix doesn't need a new tool, just a few lines in `.bashrc`.

The idea is to shadow the `sudo` command with a Bash function of the same name. Every other use of `sudo` still goes straight through, but the moment the first argument is `rm`, it stops and asks first.

```bash [.bashrc]
# rm confirmation
sudo() {
  if [ "$1" = "rm" ]; then
    echo -n "Are you sure you want to delete files/folders with sudo? (y/n) "
    read ans
    if [[ $ans == [Yy]* ]]; then
      command sudo rm "${@:2}"
    else
      echo "Deletion cancelled."
    fi
  else
    command sudo "$@"
  fi
}
```

## How it works

- `sudo() { ... }` defines a function named `sudo`. Bash looks up functions before it looks up commands on the `PATH`, so typing `sudo` in a terminal now runs this instead of `/usr/bin/sudo`, no alias trickery involved.
- `if [ "$1" = "rm" ]` only looks at the very first word after `sudo`. `sudo rm -rf /srv/docker/old-stack` matches, `sudo apt update` doesn't.
- On a match, it prints the question, reads the answer into `$ans`, and `[[ $ans == [Yy]* ]]` accepts `y`, `Y`, `yes`, anything starting with either case of Y.
- `command sudo rm "${@:2}"` is the part that actually deletes. `command` steps around the function so it doesn't call itself, and `${@:2}` is every argument after `rm`, so `-rf /srv/docker/old-stack` is passed through untouched.
- Anything that isn't `rm` falls into the `else` and runs exactly as if the function didn't exist: `command sudo "$@"`.

## Installing it

::steps{level="3"}
### Open your shell config

```bash [Terminal]
nano ~/.bashrc
```

### Paste the function

Add the block above at the end of the file, then save and exit.

### Reload it

```bash [Terminal]
source ~/.bashrc
```

### Try it

```console [Terminal]
$ sudo rm -rf /tmp/test
Are you sure you want to delete files/folders with sudo? (y/n) n
Deletion cancelled.
```

Answer `y` and it runs for real. Anything that isn't `rm`, `sudo apt update`, `sudo systemctl restart docker`, goes through without a prompt.

### Done !
::

::note
This lives in `~/.bashrc`, so it only applies to your interactive shell, not to scripts, cron jobs, or another user's session. That's the point: it catches you, typing, not a program calling `sudo rm` on purpose.
::

## What it won't catch

This is a habit-breaker, not a sandbox. It only fires when `rm` is the literal first word after `sudo`, so anything that reaches `rm` a different way skips it entirely:

- `sudo -i rm -rf /` or `sudo su -c "rm -rf /"`, the first argument is `-i` or `su`, not `rm`
- `sudo bash -c "rm -rf /srv/docker"`, same reason, `rm` is buried inside the string bash runs
- `sudo find /srv/docker -delete`, deletes just as permanently, and never calls `rm` at all
- `rm` without `sudo` on files you already own

Real protection against the last category is a proper backup, [Backrest](https://github.com/garethgeorge/backrest) and the [Docker stop script](/nonsense/bash/backrest-docker-stop) covered elsewhere in this section, or otherwise. This function is worth having anyway: the accidents it does catch are the ones that actually happen, a hurried `sudo rm -rf` with a typo in the path, not a deliberate attempt to work around it.