executable ELF is rm-ed from disk, but still running RAM..

[Mulyadi Santosa]

On Tue, May 31, 2011 at 11:56, Vikash Kumar <vikashskumar at gmail.com> wrote:
> AFAIK Linux removes the directory entry and reduces the reference count of
> Inode of a running process and rm is successful. So, you can't see it in the
> file system anymore. However as the program is still running the inode
> reference count is still not zero and so the Inode and hence file is
> actually not deleted yet. When the program will terminate, Inode ref count
> will drop to zero and in that case the Inode and file will be freed.
> "The design of Unix Operating System" by Maurice J. Bach It covers these
> basic design principles in good detail.

Thanks people...you put valuable feedback to me. It's good to see I am
around knowledgeable people :)

As for the deletion case, I might do further research to see how the
very recent Linux kernel behaves. Hopefully, if the time permits...

-- 
regards,

Mulyadi Santosa
Freelance Linux trainer and consultant

blog: the-hydra.blogspot.com
training: mulyaditraining.blogspot.com