14

Everything is in the title, but more officially :

Why does Windows let me rename a running executable, but not delete it?

Improve this question

3 Answers 3

Reset to default
13

There really is no such thing as renaming a file. A file can have more than one name or no name, so it's not the file that you're renaming but the directory entry. Renaming is an operation on the directory entry, which is not affected by the fact that the file is locked for execution.

Improve this answer
4
  • 2
    Hmm, why then any attempt to rename a regular file that is open for reading or writing fails?
    – Serge
    Oct 15, 2012 at 20:25
  • 6
    @Serge: Because the process that opened the file specifically asked for it to fail by setting the appropriate open flags.
    – David Schwartz
    Oct 15, 2012 at 20:41
  • what specific open flags?
    – n611x007
    Aug 29, 2013 at 19:23
  • 3
    Most likely, setting dwShareMode to zero or using the OF_SHARE_COMPAT or OF_SHARE_EXCLUSIVE flags.
    – David Schwartz
    Aug 29, 2013 at 19:40
7

It does not allow to delete the executable file and DLLs because Windows maps parts of the executable files into memory as part of the process creation, so it need the file during the lifetime of the process.

Unfortunately I have no true reason why it still allows to rename such files. I guess that this is done to enable the update of the dlls and exe files while they are running to minimize the service interruption time.

The linux (unix in general) in contrast allows to delete an executable file while it is running:

tmp]$ cp /usr/bin/md5sum .;ll md5*; \
(./md5sum /home/pub/iso/FC5/FC-5-i386-DVD.iso & ); \
rm md5sum ; ll md5*;ps -f
-rwxr-xr-x 1 sergey sergey 37276 Oct 16 02:38 md5sum
ls: cannot access md5*: No such file or directory
UID        PID  PPID  C STIME TTY          TIME CMD
sergey    2423  2422  0 02:32 pts/1    00:00:00 -bash
sergey    2533     1  0 02:38 pts/1    00:00:00 ./md5sum /home/pub/iso/FC5/FC-5-
sergey    2536  2423  0 02:38 pts/1    00:00:00 ps -f
Improve this answer
9
  • Note that e.g. Linux also maps parts of the executable files into memory, but has no problem allowing you to delete a running executable.
    – ChrisInEdmonton
    Oct 15, 2012 at 20:31
  • 2
    @ChrisInEdmonton Yes, but this I explained here: unix.stackexchange.com/questions/49299/…
    – Serge
    Oct 15, 2012 at 20:32
  • Serge, nice explanation there. :)
    – ChrisInEdmonton
    Oct 15, 2012 at 21:56
  • Linux will not allow you to delete a file while it is executing. You can, however, remove directory entries, since those are not executing.
    – David Schwartz
    Oct 15, 2012 at 22:10
  • @DavidSchwartz please see the update to my answer. Linux does allow me to unlink any file being executed provided I have enough permissions to delete that file.
    – Serge
    Oct 15, 2012 at 22:43
2

I guess it is because a name is just an attribute of the same binary content of the file, so as long as the data is there, the handle, held by the running process for it won't change.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.