mv command not working as intended on linux CENT/REDHAT OS

Question

This is with respect to recent issue that has been faced by me. Suddenly post exection of a mv command Linux box went un-responsive on various front, below is the overall description of the issue that happened.

1) move command executed with /* in the destination

# mv -f *.txt /*

2) command has successfully moved the desired content but not to / it moved it to /var

3) along with desired content it also moved content of / folders recursivly to /var location.

4) this resulted in movement of all binary files and folders required for normal OS operations

5) this movement restricted login through SSH/console.

6) post restoration of folders from /var location system got functions normally.

I tried replicating the issue on test Linux Box and it got replicated as below,

[root@TestVM001 ~]# ls -lrt
total 84
-rw-r--r-- 1 root root  4224 Feb  5 17:28 install.log.syslog
-rw-r--r-- 1 root root 38536 Feb  5 17:35 install.log
-rw------- 1 root root   955 Feb  5 17:35 anaconda-ks.cfg
drwxr-xr-x 2 root root  4096 Feb  5 20:03 Desktop
-rw-r--r-- 1 root root   119 Feb  5 20:28 ifcfg-eth0
-rw-r--r-- 1 root root   119 Feb  6 15:17 ifcfg-eth1
-rw-r--r-- 1 root root    44 Mar  1 05:08 student.txt
drwxr-xr-x 3 root root  4096 Mar 14 17:59 admin

[root@TestVM001 ~]# mv -vf * /*
`admin' -> `/var/admin'
`anaconda-ks.cfg' -> `/var/anaconda-ks.cfg'
`Desktop' -> `/var/Desktop'
`ifcfg-eth0' -> `/var/ifcfg-eth0'
`ifcfg-eth1' -> `/var/ifcfg-eth1'
`install.log' -> `/var/install.log'
`install.log.syslog' -> `/var/install.log.syslog'
`student.txt' -> `/var/student.txt'
`/bin' -> `/var/bin'
mv: cannot move `/boot' to `/var/boot': Device or resource busy
mv: cannot move `/dev' to `/var/dev': Device or resource busy
`/etc' -> `/var/etc'
`/home' -> `/var/home'
mv: cannot move `/lib' to a subdirectory of itself, `/var/lib'
`/lost+found' -> `/var/lost+found'
`/media' -> `/var/media'
`/mnt' -> `/var/mnt'
`/opt' -> `/var/opt'
mv: cannot move `/proc' to `/var/proc': Device or resource busy
`/root' -> `/var/root'
`/sbin' -> `/var/sbin'
`/selinux' -> `/var/selinux'
`/srv' -> `/var/srv'
mv: cannot move `/sys' to `/var/sys': Device or resource busy
`/tmp' -> `/var/tmp'
`/usr' -> `/var/usr'

[root@TestVM001 ~]# ls
-bash: /bin/ls: No such file or directory

[root@TestVM001 ~]# ls -lrt
-bash: /bin/ls: No such file or directory

[root@TestVM001 ~]# cd /
.autofsck     boot/         lib/          sys/
.autorelabel  dev/          proc/         var/

[root@TestVM001 ~]# cd /var/
account/            games/              lost+found/         selinux/
admin/              gdm/                mail/               spool/
anaconda-ks.cfg     home/               media/              srv/
bin/                ifcfg-eth0          mnt/                student.txt
cache/              ifcfg-eth1          nis/                tmp/
crash/              install.log         opt/                tux/
cvs/                install.log.syslog  preserve/           usr/
db/                 lib/                racoon/             www/
Desktop/            local/              root/               yp/
empty/              lock/               run/
etc/                log/                sbin/

Questions about this scenarios is, 1) Why mv command resulted in such behavior?

2) Is this behavior is a known Bug or Risk?

3) IS there any known way to restrict this, similar to alias concept usage?

Answer 1

When you do echo mv -f *.txt /* you will see that the last * has been expanded to /var. So you actually asked to move all files in / to /var.

The answers to your questions:
1) Why mv command resulted in such behavior?
mv tried to do exactly what you asked
2) Is this behavior is a known Bug or Risk?
It's not a bug. Unix/Linux do not have prompts "are you sure" but trust the you.
3) IS there any known way to restrict this, similar to alias concept usage?
You should do all normal work as a plain user, not root. The permissions on the important files are such, that they do not allow a normal user to do something harmful.
And when you must do something as root, be very careful! Trying to move txt files to the root is suspicious: The root partition is small and should be kept for system files. Are the .txt files from Windows?