docudjeex/content/en/5.nonsense/3.bash/6.rm-confirmation.md

title, description

title	description
rm Confirmation Guard	A small Bash function that wraps sudo and asks for confirmation before running rm, so a typo doesn't delete files owned by root.

:ellipsis{left=0px width=40rem top=10rem blur=140px zIndex=60}

rm doesn't ask twice. No recycle bin, no "are you sure", especially not with sudo in front of it, where a stray space or the wrong variable can wipe something you own no permission to double-check. It's the single most destructive habit a terminal builds into you, and the fix doesn't need a new tool, just a few lines in .bashrc.

The idea is to shadow the sudo command with a Bash function of the same name. Every other use of sudo still goes straight through, but the moment the first argument is rm, it stops and asks first.

# rm confirmation
sudo() {
  if [ "$1" = "rm" ]; then
    echo -n "Are you sure you want to delete files/folders with sudo? (y/n) "
    read ans
    if [[ $ans == [Yy]* ]]; then
      command sudo rm "${@:2}"
    else
      echo "Deletion cancelled."
    fi
  else
    command sudo "$@"
  fi
}

How it works

• sudo() { ... } defines a function named sudo. Bash looks up functions before it looks up commands on the PATH, so typing sudo in a terminal now runs this instead of /usr/bin/sudo, no alias trickery involved.
• if [ "$1" = "rm" ] only looks at the very first word after sudo. sudo rm -rf /srv/docker/old-stack matches, sudo apt update doesn't.
• On a match, it prints the question, reads the answer into $ans, and [[ $ans == [Yy]* ]] accepts y, Y, yes, anything starting with either case of Y.
• command sudo rm "${@:2}" is the part that actually deletes. command steps around the function so it doesn't call itself, and ${@:2} is every argument after rm, so -rf /srv/docker/old-stack is passed through untouched.
• Anything that isn't rm falls into the else and runs exactly as if the function didn't exist: command sudo "$@".

Installing it

::steps{level="3"}

Open your shell config

nano ~/.bashrc

Paste the function

Add the block above at the end of the file, then save and exit.

Reload it

source ~/.bashrc

Try it

$ sudo rm -rf /tmp/test
Are you sure you want to delete files/folders with sudo? (y/n) n
Deletion cancelled.

Answer y and it runs for real. Anything that isn't rm, sudo apt update, sudo systemctl restart docker, goes through without a prompt.

Done !

::

::note This lives in ~/.bashrc, so it only applies to your interactive shell, not to scripts, cron jobs, or another user's session. That's the point: it catches you, typing, not a program calling sudo rm on purpose. ::

What it won't catch

This is a habit-breaker, not a sandbox. It only fires when rm is the literal first word after sudo, so anything that reaches rm a different way skips it entirely:

• sudo -i rm -rf / or sudo su -c "rm -rf /", the first argument is -i or su, not rm
• sudo bash -c "rm -rf /srv/docker", same reason, rm is buried inside the string bash runs
• sudo find /srv/docker -delete, deletes just as permanently, and never calls rm at all
• rm without sudo on files you already own

Real protection against the last category is a proper backup, Backrest and the Docker stop script covered elsewhere in this section, or otherwise. This function is worth having anyway: the accidents it does catch are the ones that actually happen, a hurried sudo rm -rf with a typo in the path, not a deliberate attempt to work around it.