How A Steam Bug Once Deleted All Of Someone’s User Data

In a retrospective, [Kevin Fang] takes us back to 2015, when on the Steam for Linux issue tracker [keyvin] opened an issue to report that starting the Steam client after moving the Steam folder had just wiped all of his user data, including his backup drive mounted under /media. According to [keyvin], he moved the standard ~/.local/share/steam to a drive mounted under /media and symlinked ~/.local/share/steam to this new location on the external drive. He then tried starting Steam, which failed, before Steam crashed and tried reinstalling itself. That’s when [keyvin] realized that Steam had apparently recursively deleted everything owned by his user from the root folder.

The infamous Valve code that made Linux users sad.
The infamous Valve code that made Linux users sad.

In the issue thread, user [doofy] got hit by the same bug when trying to directly start the ~/.local/share/steam/steam.sh script with debugging enabled. He then was the first to point out the rm -rf in that steam.sh script, but since this particular line is in a function only called when Steam tries to remove and reinstall itself to ‘fix’ a botched start, how did this happen? Ultimately it seems to be because of the STEAMROOT variable being set to an empty string, and another unset variable triggering the reset_steam() function, leading to the demise of all the user data.

Since then Valve has presumably fixed the issue, as no further users have filed tickets, but it’s concerning that a similar issue seems to still exist on Windows. Whether or not the original Linux issue has been fixed, it shows clearly how one should always check return values and perhaps, just maybe, never do an automated rm -rf or equivalent.

14 thoughts on “How A Steam Bug Once Deleted All Of Someone’s User Data

    1. +1

      My bash is a little rusty but perhaps something like this might work:

      if [ -z “$STEAMROOT”]
      then
      echo “No steam installation has been found. Aborting.”
      exit
      else
      echo “This will remove and reinstall your steam installation from “$STEAMROOT””
      rm -r “$STEAMROOT”/*
      fi

      It’s bad enough doing rm -rf in your home directory, but if you’ve got root priveleges to run the script then your whole system will be hosed, just like those guys. Been there. Done that. Got the t-shirt before I actually knew what I was doing.
      “Why can’t I log into my user account anymore? Why won’t my desktop come up? OH FSCK!”.
      Even worse if a piece of software actually runs that command itself!

      1. More allow tests instead of fail tests.
        rmpath=$(realpath “$STEAMROOT”)
        … must exist
        … must be a folder
        … must contain at least 3 parts (insist on /home folder?)
        … must contain “Steam” or “steam” or “steamdata” (seems prudent)

        then maybe, but probably still prompt the user:
        rm -rf “$rmpath”

        Because loosing data is a cardinal sin. But loosing end-user data is just evil.

  1. Steam initially was a steaming pile of crap,even well before linux support. I remember the half-life 2 debacle. The servers could not begin the handle the load. The DVD image was just basically a filler, to install steam, and re-download all the content. Massive issues.

    Now, Steam is awesome. The Epic game store launcher however, is an epic pile of feces. Slow, bloated, etc.

    GoG does not fare much better, but at least GoG games don’t have any protection.

    In Dr.Breens voice. ” I will once again remind all users, of the importance of backups, and the 3,2,1 rule” Be Safe, Be Aware.

  2. In my opinion Steam has lost it’s way a few years ago. The switch to a browser based UI, I suppose, made sense. Allow the people that actually want to work on the store front to not have their creativity blocked, use modern web tools, sure.

    But this is a different kind of work. Don’t engineer, just develop. Find bits and glue them together has fast as you can, it’s an integration shop.

    The installer is now an integral part of the store front, with full browser dependency. While there is nothing wrong with using js and shell scrips to glue this all together, but at some level it needs engineering. Someone who understands their responsibility, other than just a deadline.

    1. I’ve been using Steam since day 1 and have about 2000 games on Steam and use it almost daily. These days, mostly on my Steam Deck on a big TV using a docking station and a DualSense controller.

      It’s still incredibly slow because of the site integration. I feel like every new update makes the experience worse. Sure, the Steam Deck client makes actual progress, but the desktop version is getting worse. Especially when you go to your own profile and want to see the games you have there, it can take a minute or so to load, on a fast computer with gigabit internet. Even the mobile client, which also uses the browser based, takes a long time to load. I have this issue on multiple computers so it’s not that either. My normal Linux desktop has this and I have a dedicated gaming pc running Windows, which also has this issue. The site part is just horribly slow.

      I stopped using the friends section entirely because it became horrible to use.

      I wish I could downgrade to a version of a few years ago, when steam wasn’t using all this web 4.0 stuff. It used to be so fast, so snappy. It’s all gone in favor of browser based stuff. The only part that’s still fast is the games catalog inside Steam, because that’s not browser based.

  3. In my opinion, filesystems with symlinks are boobytraps created to allow this kind of mishap. Make it so clever that only an ubernerd can possibly keep track of everything the machine is doing, and it’s only a matter of time…

    Of course, that’s precisely what the ubernerds wanted, a system so complex that it would exclude anyone who wasn’t in their little club, and make them feel smugly superior. That would be fine if it hadn’t gone on to underpin most of the world’s computers.

    Not just filesystems but languages, too. We’ve spent the last 40-plus years coping with what happens when people who aren’t quite clever enough (spoiler, that’s 99.99% of programmers) write in a memory-unsafe language. A few folks who’re humble enough to admit they’re not infinitely clever are now valiantly trying to replace important things with memory-safe variants, but it’s a Sisyphean task.

    Simpler is better.

    1. “Of course, that’s precisely what the ubernerds wanted, a system so complex that it would exclude anyone who wasn’t in their little club, and make them feel smugly superior. That would be fine if it hadn’t gone on to underpin most of the world’s computers.”

      [Citation needed]

    2. Symlinks are an ease of use thing that mean you don’t need to keep track of what the machine is doing.

      A “non-ubernerd” doesn’t want to keep track of which drive or directory their commonly used things are. Symlinks let you collect things where you want them…

    3. Symlinks are specifically designed to make life easier. That’s why every major operating system allows you to make them. It has nothing to do with nerds or even ubernerds (you are on hackaday, so you should fall under that category). It has nothing to do with superiority, and it’s not excluding anyone. I don’t even understand why you are saying this or where this comes from. It’s not nice to say, it’s not based in reality, it makes no sense at all. And then insulting all programmers too. Why?

      And you can try to use fancy words like that, but it only devalues the rest of the argument. You don’t seem to understand what symlinks are and what they are used for, and attempt to cover it up with manager speak and insults.

      Try to be nice to people instead of insulting without any reason. It might work in your favor next time.

  4. Apple did something that rhymed really closely back in 2001. If you installed iTunes 2.x on your shiny newly formated Mac OS X Volume that happens to have spaces in the name, you’d be greeted by a non-working Mac because the iTunes installer happily rm -rf’d everything out of existence.

Leave a Reply

Please be kind and respectful to help make the comments section excellent. (Comment Policy)

This site uses Akismet to reduce spam. Learn how your comment data is processed.