Just wondering, what happens when you delete every single file on a running Linux system?
# rm -rf /
1
-
4try that :) just kidding.. yes– SrinAug 23, 2010 at 13:49
Add a comment
|
3 Answers
Here you are: videos of Ubuntu way and CentOS way of dying by rm / -rf.
answered Aug 23, 2010 at 13:49
-
1
-
1
-
-
I'd translate that as: How is it possible to delete a file that someone is still using?
Well, on Linux, part of your filesystem is in RAM and part is on disk. When process A opens a file and keeps it open (say a shared library), then process A gets a copy of the "inode" of the file. This is the data structure which tells the system where the file is on disk.
Now we have two inodes, one on disk and one in RAM. If a second process asks for the same file, we have three inodes. Now the second process deletes the inode. This leaves us with 1 inode: that of process A.
This means process A can still see the file (and read it) even though no one else can (because the inode on disk has been deleted and the second process is long gone). As soon as process A terminates, the last remaining inode is deleted and the file is really gone.
Linux exploits this feature in the following ways:
- You can backup any file, even those which are currently in use.
- You can install upgrades in the running system without breaking anything (well ... almost; there are some corner cases but usually, it works).
- You can create a file, delete it and then use it. No other process (and no virus, etc) can see, read or change that file. It's yours. On top of that, the file is removed automatically when your process ends. How cool is that?
So what will happen? At first, not much. Eventually, errors will be logged to deleted log files that some files can't be found. If you try to run a new command, it will fail. Stopping a process will let it drop into limbo. Eventually, you'll up with a hanging system that can't be rebooted or shut down because those commands don't exist anymore.
answered Aug 23, 2010 at 13:59
-
-
so when an inode is in RAM and the system crashes, what happens? does that turn the file undeletable or are RAM-inodes treated differently? Aug 23, 2010 at 14:15
-
Great explanation... but I was looking for the vid, although this probably will be useful sometime in the future in some way– xsznixAug 23, 2010 at 14:17
-
@Tobias: No, the space is reclaimed. This either happens because the node on disk has been marked as "for deletion"; then the next time the OS sees it, it will reclaim the space. Or a file system check will reclaim it since the structure is not referenced by anyone. When a new file is created, new blocks are allocated, a new "allocated blocks map" is written and then, last thing, the pointer to the "current allocate block map" is updated. As long as this didn't happen, the space is only allocated in RAM. Note: 50 years of development went into this file system. It is pretty good. Aug 23, 2010 at 14:32
You can test it for yourself, just install Linux in a virtual machine. Don't forget you will need to sudo or su for it to work.
answered Aug 23, 2010 at 14:25
