Re: executable ELF is rm-ed from disk, but still running RAM..

[Vikash Kumar <vikashskumar@xxxxxxxxx>]

AFAIK Linux removes the directory entry and reduces the reference count of Inode of a running process and rm is successful. So, you can't see it in the file system anymore. However as the program is still running the inode reference count is still not zero and so the Inode and hence file is actually not deleted yet. When the program will terminate, Inode ref count will drop to zero and in that case the Inode and file will be freed.

"The design of Unix Operating System" by Maurice J. Bach It covers these basic design principles in good detail.

On Tue, May 31, 2011 at 10:12 AM, Manish Katiyar <mkatiyar@xxxxxxxxx> wrote:

On Mon, May 30, 2011 at 8:45 PM, Mulyadi Santosa
<mulyadi.santosa@xxxxxxxxx> wrote:
> hi..
>
> On Tue, May 31, 2011 at 09:57, Manish Katiyar <mkatiyar@xxxxxxxxx> wrote:
>> How will "rm /bin/rm" work otherwise ?
>
> ok, makes me think another case....suppose we erase the related data
> blocks in the disk that correlate to running binary.... does Linux
> kernel follow that with erasing all the related page cache? or is it
> possible that temporarily cache of the disk blocks still survived?

I don't know for sure, but my guess is that the OS wouldn't notice it
till it goes out of cache and it has to reload.

--
Thanks -
Manish

_______________________________________________
Kernelnewbies mailing list
Kernelnewbies@xxxxxxxxxxxxxxxxx
http://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies

_______________________________________________
Kernelnewbies mailing list
Kernelnewbies@xxxxxxxxxxxxxxxxx
http://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies