Just wondering, what happens when you delete every single file on a running Linux system?

# rm -rf /

  • 4
    try that :) just kidding.. yes – Srin Aug 23 '10 at 13:49

Here you are: videos of Ubuntu way and CentOS way of dying by rm / -rf.

| improve this answer | |
  • 1
    The Slackware video was kind of a letdown. – zildjohn01 Aug 23 '10 at 13:57
  • 1
    Great vids. Except for the Slackware one. – xsznix Aug 23 '10 at 14:15
  • Ok, changed to CentOS (in a VM). Sorry for the fail :) – whitequark Aug 23 '10 at 14:24
  • Slackware is probably just missing a --no-preserve-root. – Daniel Beck Apr 30 '13 at 8:27

I'd translate that as: How is it possible to delete a file that someone is still using?

Well, on Linux, part of your filesystem is in RAM and part is on disk. When process A opens a file and keeps it open (say a shared library), then process A gets a copy of the "inode" of the file. This is the data structure which tells the system where the file is on disk.

Now we have two inodes, one on disk and one in RAM. If a second process asks for the same file, we have three inodes. Now the second process deletes the inode. This leaves us with 1 inode: that of process A.

This means process A can still see the file (and read it) even though no one else can (because the inode on disk has been deleted and the second process is long gone). As soon as process A terminates, the last remaining inode is deleted and the file is really gone.

Linux exploits this feature in the following ways:

  1. You can backup any file, even those which are currently in use.
  2. You can install upgrades in the running system without breaking anything (well ... almost; there are some corner cases but usually, it works).
  3. You can create a file, delete it and then use it. No other process (and no virus, etc) can see, read or change that file. It's yours. On top of that, the file is removed automatically when your process ends. How cool is that?

So what will happen? At first, not much. Eventually, errors will be logged to deleted log files that some files can't be found. If you try to run a new command, it will fail. Stopping a process will let it drop into limbo. Eventually, you'll up with a hanging system that can't be rebooted or shut down because those commands don't exist anymore.

| improve this answer | |
  • Nice explanation of files and inodes – invert Aug 23 '10 at 14:09
  • so when an inode is in RAM and the system crashes, what happens? does that turn the file undeletable or are RAM-inodes treated differently? – Tobias Kienzler Aug 23 '10 at 14:15
  • Great explanation... but I was looking for the vid, although this probably will be useful sometime in the future in some way – xsznix Aug 23 '10 at 14:17
  • @Tobias: No, the space is reclaimed. This either happens because the node on disk has been marked as "for deletion"; then the next time the OS sees it, it will reclaim the space. Or a file system check will reclaim it since the structure is not referenced by anyone. When a new file is created, new blocks are allocated, a new "allocated blocks map" is written and then, last thing, the pointer to the "current allocate block map" is updated. As long as this didn't happen, the space is only allocated in RAM. Note: 50 years of development went into this file system. It is pretty good. – Aaron Digulla Aug 23 '10 at 14:32

You can test it for yourself, just install Linux in a virtual machine. Don't forget you will need to sudo or su for it to work.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.