executable ELF is rm-ed from disk, but still running RAM..

[Vikash Kumar]

AFAIK Linux removes the directory entry and reduces the reference count of
Inode of a running process and rm is successful. So, you can't see it in the
file system anymore. However as the program is still running the inode
reference count is still not zero and so the Inode and hence file is
actually not deleted yet. When the program will terminate, Inode ref count
will drop to zero and in that case the Inode and file will be freed.

"The design of Unix Operating System" by Maurice J. Bach It covers these
basic design principles in good detail.


On Tue, May 31, 2011 at 10:12 AM, Manish Katiyar <mkatiyar at gmail.com> wrote:

> On Mon, May 30, 2011 at 8:45 PM, Mulyadi Santosa
> <mulyadi.santosa at gmail.com> wrote:
> > hi..
> >
> > On Tue, May 31, 2011 at 09:57, Manish Katiyar <mkatiyar at gmail.com>
> wrote:
> >> How will "rm /bin/rm" work otherwise ?
> >
> > ok, makes me think another case....suppose we erase the related data
> > blocks in the disk that correlate to running binary.... does Linux
> > kernel follow that with erasing all the related page cache? or is it
> > possible that temporarily cache of the disk blocks still survived?
>
> I don't know for sure, but my guess is that the OS wouldn't notice it
> till it goes out of cache and it has to reload.
>
> --
> Thanks -
> Manish
>
> _______________________________________________
> Kernelnewbies mailing list
> Kernelnewbies at kernelnewbies.org
> http://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.kernelnewbies.org/pipermail/kernelnewbies/attachments/20110531/fe0eda3a/attachment-0001.html