On Tue, Jul 23, 2002 at 10:55:41PM +0200, Michael Hoennig wrote: > ok, then at least lsof should report such files. Actually I forgot > something: Even after all processes holding this file handle, the storage > was never freed, only after umount/mount! In my experience, lsof has at times been broken on Linux. This is no wonder, as lsof supports lots of *nix systems, and some of the interfaces are fragile. Also, be sure to run it as root; depending on how things are installed (e.g., which kernel, suid bits), you may not see process info that you can't access in /proc. The simplest way to see what processes are standing on a filesystem is to use (as root) /sbin/fuser -m <mntpoint> This is from the (Linux-specific) psmisc package. See fuser(1). for details. > I have not checked it yet, but > if this storage is not even counted in quota, which I guess is the case, > it is a possible local DoS. Any user, even with a reasonable quota, could > flood the device. The quota is associated with the owner of the inode, which doesn't change just because the file has no links in the filesystem. When the inode is release after the last close, and the storage is returned, the quota will be credited to the user. Regards, Bill Rugolsky
