Just wondering, what happens when you delete every single file on a running Linux system?
# rm -rf /
Asked
Active
Viewed 7,269 times
3 Answers
18
I'd translate that as: How is it possible to delete a file that someone is still using?
Well, on Linux, part of your filesystem is in RAM and part is on disk. When process A opens a file and keeps it open (say a shared library), then process A gets a copy of the "inode" of the file. This is the data structure which tells the system where the file is on disk.
Now we have two inodes, one on disk and one in RAM. If a second process asks for the same file, we have three inodes. Now the second process deletes the inode. This leaves us with 1 inode: that of process A.
This means process A can still see the file (and read it) even though no one else can (because the inode on disk has been deleted and the second process is long gone). As soon as process A terminates, the last remaining inode is deleted and the file is really gone.
Linux exploits this feature in the following ways:
- You can backup any file, even those which are currently in use.
- You can install upgrades in the running system without breaking anything (well ... almost; there are some corner cases but usually, it works).
- You can create a file, delete it and then use it. No other process (and no virus, etc) can see, read or change that file. It's yours. On top of that, the file is removed automatically when your process ends. How cool is that?
So what will happen? At first, not much. Eventually, errors will be logged to deleted log files that some files can't be found. If you try to run a new command, it will fail. Stopping a process will let it drop into limbo. Eventually, you'll up with a hanging system that can't be rebooted or shut down because those commands don't exist anymore.
Aaron Digulla
- 7,235
0
You can test it for yourself, just install Linux in a virtual machine. Don't forget you will need to sudo or su for it to work.
Tobias Kienzler
- 4,629