From mboxrd@z Thu Jan 1 00:00:00 1970 From: mulyadi.santosa@gmail.com (Mulyadi Santosa) Date: Tue, 31 May 2011 13:53:13 +0700 Subject: executable ELF is rm-ed from disk, but still running RAM.. In-Reply-To: References: Message-ID: To: kernelnewbies@lists.kernelnewbies.org List-Id: kernelnewbies.lists.kernelnewbies.org On Tue, May 31, 2011 at 11:56, Vikash Kumar wrote: > AFAIK Linux removes the directory entry and reduces the reference count of > Inode of a running process and rm is successful. So, you can't see it in the > file system anymore. However as the program is still running the inode > reference count is still not zero and so the Inode and hence file is > actually not deleted yet. When the program will terminate, Inode ref count > will drop to zero and in that case the Inode and file will be freed. > "The design of Unix Operating System" by Maurice J. Bach It covers these > basic design principles in good detail. Thanks people...you put valuable feedback to me. It's good to see I am around knowledgeable people :) As for the deletion case, I might do further research to see how the very recent Linux kernel behaves. Hopefully, if the time permits... -- regards, Mulyadi Santosa Freelance Linux trainer and consultant blog: the-hydra.blogspot.com training: mulyaditraining.blogspot.com