1

If I create a file named /home/martin/testfile.txt, open this file with less utility, delete /home/martin/testfile.txt file and restore it from file descriptor directory under the /proc/31148, where 31148 is the PID of the less utility, then lsof | grep testfile.txt still shows testfile.txt as deleted:

martin@potato:~$ echo test > testfile.txt
martin@potato:~$ ls -li ~/testfile.txt
247 -rw-r--r-- 1 martin martin 5 24. veebr 05:02 /home/martin/testfile.txt
martin@potato:~$ xterm -hold -e "less /home/martin/testfile.txt" &
[1] 31145
martin@potato:~$ lsof | grep testfile.txt
less      31148      martin    4r      REG                8,9        5        247 /home/martin/testfile.txt
martin@potato:~$ rm -v /home/martin/testfile.txt
removed `/home/martin/testfile.txt'
martin@potato:~$ lsof | grep testfile.txt
less      31148      martin    4r      REG                8,9        5        247 /home/martin/testfile.txt (deleted)
martin@potato:~$ cp -v /proc/31148/fd/4 /home/martin/testfile.txt
`/proc/31148/fd/4' -> `/home/martin/testfile.txt'
martin@potato:~$ ls -li ~/testfile.txt
263 -rw-r--r-- 1 martin martin 5 24. veebr 05:04 /home/martin/testfile.txt
martin@potato:~$ cat ~/testfile.txt
test
martin@potato:~$ lsof | grep testfile.txt
less      31148      martin    4r      REG                8,9        5        247 /home/martin/testfile.txt (deleted)
martin@potato:~$

Is this because testfile.txt got a new inode number? Or is there some other reason why lsof displays restored file as deleted?

Martin
  • 332
  • 3
  • 10
  • 28

1 Answers1

3

Yes, they are two different files. By copying (cp) the file from /proc, you are simply creating a new file with a new inode. You can test it with the statcommand -

[root@server2 tmp]# stat testfile.txt File: test.txt Size: 9 Blocks: 8 IO Block: 4096 regular file Device: 803h/2051d Inode: 3684616 Links: 1 Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root) Access: 2013-02-23 19:01:14.000679872 -0800 Modify: 2013-02-23 19:01:14.000679872 -0800 Change: 2013-02-23 19:01:14.000679872 -0800

[root@server2 tmp]# stat testfile.txt File: test.txt Size: 9 Blocks: 8 IO Block: 4096 regular file Device: 803h/2051d Inode: 3684617 Links: 1 Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root) Access: 2013-02-23 19:02:46.422854012 -0800 Modify: 2013-02-23 19:02:44.507799688 -0800 Change: 2013-02-23 19:02:44.507799688 -0800

Daniel t.
  • 9,061
  • 1
  • 32
  • 36
  • Try using `mv` and observing the behaviour. mv is useful if you want/need to preserve everything about the file including the inode and excepting the name. You can then `cp` the `mv`'ed file back into place with the old name. – gm3dmo Feb 24 '13 at 09:06
  • @davey But it isn't possible to move a file under _/proc_ directory, is it? For example: if I execute `martin@potato:~$ mv -f /proc/3688/fd/4 /home/martin/testfile.txt`, I receive `mv: cannot remove `/proc/3688/fd/4': Permission denied` error. – Martin Feb 24 '13 at 15:31