/bin /etc /lib64 /root /sbin deleted or moved by mv folder/* /* while su

If your system has busybox installed, you can use this to put things back.

busybox is a binary with lots of standard utilities built into it. Things such as mv, sh, ls, etc.

From your comment on Pavel's answer, it sounds like everything ended up in /var. You can try doing /var/bin/busybox mv /var/{bin,etc,lib32,lib64,root,sbin,usr} /. That should get most of your system operational again. There are a few directories such as /tmp which also exist as /var/tmp, so you can't just move them. Hopefully those are the ones that mv complained about and they were left alone.

 

Getting a root shell

You also mentioned that you lost your root shell, and that su is giving you a ld-linux library error. You might be able to use the following:

LD_LIBRARY_PATH=/var/lib64 /var/lib64/ld-linux-x86-64.so.2 /var/bin/su

Note: Upon attempting this, it does not work. This is because su requires several files in /etc (passwd, pam.d, and others). If /etc were still intact, this would have a good chance of succeeding.

 

Without busybox

If you do not have busybox available, you might be able to use the same ld-linux trick as for su:

LD_LIBRARY_PATH=/var/lib64 /var/lib64/ld-linux-x86-64.so.2 /var/bin/mv /var/{bin,etc,lib32,lib64,root,sbin,usr} /

 

From a live CD

As discussed in the comments, if you've lost the root shell, you're pretty much stuck. Basically in order to fix this you need root privileges. The only way to get there is to have a utility such as su or sudo escalate your permissions (both of which are non-functional at this point), or hijack another program already running as root (depending on what's running, not likely possible).

This leaves the only option being a live CD. Once booted into a live CD (or live USB, or whatever), just mount the root volume, and move the affected directories out of /var back to their original home in /.


Synopsis of what happened

folder/* would have expanded out to something such as folder/foo and folder/bar.
/* would have expanded out to something like /bin /lib32 /lib64 /etc /home /root /var. Noting that /var is the last item.
So when the shell expanded out all those globs, it would have run something like this:

mv folder/foo folder/bar /bin /lib32 /lib64 /etc /home /root /var

As /var is the last item in the list, everything got moved into it.


Why /var/bin/su errors with /lib64/ld-linux-x86-64.so.2: bad ELF interpreter: No such file or directory

Almost all binaries in linux are dynamically linked against ld-linux. ld-linux is the library responsible for loading the other libraries needed by a binary. On your system this lives at /lib64/ld-linux-x86-64.so.2. Since this directory got moved, any dynamically linked executable will no longer work.

The reason busybox works is that busybox is statically linked. It does not use ld-linux.


mv folder/* ./* is wrong as well. You should be more careful about the semantics of the commands you run. The mv command with more than two arguments just takes all argument except the last one and moves the paths they point to into the directory specified in the last argument.

To move all directories (except hidden ones) from folder to the current directory, you should use:

mv folder/* .

You have broken your running system. Your shell and builtin commands continue to work. You will have to boot a live CD and move the directories back. I'm not aware of a bash builtin to move/rename files that would allow you to fix the situation without rebooting, see Patrick's answer for more details.


I accidently moved /usr to /usr_old and everything went to hell. Luckily I stayed in the prompt and was able to execute the following command to restore the usr folder:

LD_LIBRARY_PATH=/usr_old/lib64 /usr_old/lib64/ld-linux-x86-64.so.2 /usr_old/bin/mv /usr_old /usr

Tags:

Shell

Centos