Remove all user-recoverable files during Linux wipe

[ddribeiro]

Fleet version:

Web browser and operating system:

---

💥  Actual behavior

After wiping a Linux system, customer-cisneros reported that the system still had quite a few artifacts on the system. Specifically the following folders:
/opt
/etc
/var
/usr
/srv

🧑‍💻  Steps to reproduce

1. Enroll a Linux host to Fleet
2. Head to Host details page and select Actions > Wipe
3. Check to see that these folders still have stuff in them:

/opt
/etc
/var
/usr
/srv

🕯️ More info (optional)

• customer-cisneros: Slack thread: https://fleetdm.slack.com/archives/C072L58U878/p1747161191292529

🛠️ To fix

Update the Linux wipe script to remove content from these folders:

/opt
/etc
/var
/usr
/srv

[zayhanlon]

@noahtalerman is this a bug?

[noahtalerman]

@zayhanlon I think yes. Expected behavior is for Fleet to remove everything we can from the workstation. It sounds like cisneros ran into some locations we hadn't considered.

We updated this issue to use the bug template.

Original issue description here:

Slack thread: https://fleetdm.slack.com/archives/C072L58U878/p1747161191292529

Problem

After wiping a Linux system, customer-cisneros reported that the system still had quite a few artifacts on the system. Specifically the following folders:
/opt
/etc
/var
/usr
/srv

cisneros' desired state would be to completely wipe the hard drive, or at least remove all user-recoverable files so they cannot be recovered after the fact.

What have you tried?

Cisneros wiped a Linux computer from Fleet. After the wipe, they booted the computer from a live USB, decrypted the partition of the internal drive, and were able to look through the contents of the drive to see the directories that were not removed during the wipe.

Potential solutions

The wipe script that Fleet uses should remove all directories where they might be user-recoverable files so they cannot be exfiltrated after the fact. Using the wipe script should result in as close to a fresh install of Linux as possible.

What is the expected workflow as a result of your proposal?

A Fleet admin would issue a wipe command to a Linux computer > the computer would wipe as expected > if the Linux admin booted to a live USB drive and decrypted the drive that was just wiped, they would not see any artifacts on the drive that was just wiped. It would be like a fresh install of the OS.

[noahtalerman]

FYI @sharon-fdm @xpkoala, @allenhouchins is going to fix this bug. We moved it to awaiting QA on the #g-orchestration board. When the fix is in, can you please help us QA it?

[zayhanlon]

Thank you!
@ddribeiro fyi