3

I would like some guidance on understanding what an open file is in Linux? What are open files also called in Linux? Are open files and processes the same in Linux? Any difference between open file and regular file in Linux?

$ lsof /run
COMMAND    PID  USER   FD   TYPE DEVICE SIZE/OFF  NODE NAME
systemd      1  root   31u  FIFO   0,24      0t0 19314 /run/initctl
systemd      1  root   38u  FIFO   0,24      0t0 19331 /run/dmeventd-server
systemd      1  root   39u  FIFO   0,24      0t0 19332 /run/dmeventd-client
systemd-j  713  root  mem    REG   0,24  8388608 12871 /run/log/journal/aaff550ef54147ddb4d1776d86b04055/system.journal
NetworkMa  881  root   20w  FIFO   0,24      0t0 24896 /run/systemd/inhibit/1.ref
rhsmcertd  906  root    3wW  REG   0,24        0 22479 /run/lock/subsys/rhsmcertd
crond      910  root    3uW  REG   0,24        4 24002 /run/crond.pid
rsyslogd  1224  root  mem    REG   0,24  8388608 12871 /run/log/journal/aaff550ef54147ddb4d1776d86b04055/system.journal
rsyslogd  1224  root   10r   REG   0,24  8388608 12871 /run/log/journal/aaff550ef54147ddb4d1776d86b04055/system.journal
sshd      1651  root   11w  FIFO   0,24      0t0 27390 /run/systemd/sessions/1.ref
sshd      1666 admin   11w  FIFO   0,24      0t0 27390 /run/systemd/sessions/1.ref


In the above example, the first column shows what processes are using what files under the directory /run. Is my understanding correct? Are the processes (first column) known as open files or are the regular files (last column) known as open files?

In the below example, 890=sshd

lsof -p 890

out of many lines in the output, some are below

CMD   PID USER   FD  TYPE DEVICE SIZE/OFF     NODE NAME

sshd  890 root  txt  REG  253,0   886344   646480 /usr/sbin/sshd
sshd  890 root  mem  REG  253,0  6940392 34389337 /var/lib/sss/mc/group
sshd  890 root  mem  REG  253,0  9253600 34389336 /var/lib/sss/mc/passwd


So, in above example, sshd process is using passwd and passwd is one of the open files here, right?
How is CMD (command) the first column showing a process and NAME column showing commands (like passwd, etc.)? Can you edit an open file manually?

pravi
  • 129

1 Answers1

13

Are open files and processes the same in Linux?

Absolutely not.

Though a process does always hold a reference to its own file as well (not a file descriptor but a memory mapping, which lsof lists as txt). But that doesn't mean they are the same thing.

Are the processes (first column) known as open files or are the regular files (last column) known as open files?

I would say neither. The references held by processes – file descriptors and such (fourth column titled FD) – are the "open files". Of course, the latter term can often refer to the actual file as well, but file descriptors are the primary means by which a program holds something open, be it a file or a socket or a device. (Windows calls the same concept a "handle".)

The point being: When a program opens a file, that doesn't actually change the state or type of the file itself, but only creates a file descriptor (held by the process) that references the file. The file is considered "open" for as long as any process holds a file descriptor for it, but still remains a regular file.

Non-file objects, like directories or sockets or pipes, also count as "open files". A process might have multiple file descriptors referencing the same file (or other object), those generally count as distinct "open files" for most purposes.

How is CMD (command) the first column showing a process and NAME column showing commands (like passwd, etc.)?

/var/lib/sss/mc/passwd is not a command. It's a completely unrelated file that just happens to have the same name as the passwd command.

But on that note, the passwd command itself comes from a file – it is really /usr/bin/passwd – and it is possible to work with it as with any other file (e.g. like you would work with an .exe file on Windows). For most programs there is no need to do so, but you can open /usr/bin/passwd in an appropriate program and it would then show up as an 'open file'.

grawity
  • 501,077