deleting everything: # rm -rf /

5

6

Just wondering, what happens when you delete every single file on a running Linux system?

# rm -rf /

xsznix

Posted 2010-08-23T13:45:56.377

Reputation: 270

4try that :) just kidding.. yes – Srin – 2010-08-23T13:49:45.933

Answers

10

Here you are: videos of Ubuntu way and CentOS way of dying by rm / -rf.

whitequark

Posted 2010-08-23T13:45:56.377

Reputation: 14 146

1The Slackware video was kind of a letdown. – zildjohn01 – 2010-08-23T13:57:35.840

1Great vids. Except for the Slackware one. – xsznix – 2010-08-23T14:15:24.330

Ok, changed to CentOS (in a VM). Sorry for the fail :) – whitequark – 2010-08-23T14:24:07.957

Slackware is probably just missing a --no-preserve-root. – Daniel Beck – 2013-04-30T08:27:24.963

18

I'd translate that as: How is it possible to delete a file that someone is still using?

Well, on Linux, part of your filesystem is in RAM and part is on disk. When process A opens a file and keeps it open (say a shared library), then process A gets a copy of the "inode" of the file. This is the data structure which tells the system where the file is on disk.

Now we have two inodes, one on disk and one in RAM. If a second process asks for the same file, we have three inodes. Now the second process deletes the inode. This leaves us with 1 inode: that of process A.

This means process A can still see the file (and read it) even though no one else can (because the inode on disk has been deleted and the second process is long gone). As soon as process A terminates, the last remaining inode is deleted and the file is really gone.

Linux exploits this feature in the following ways:

  1. You can backup any file, even those which are currently in use.
  2. You can install upgrades in the running system without breaking anything (well ... almost; there are some corner cases but usually, it works).
  3. You can create a file, delete it and then use it. No other process (and no virus, etc) can see, read or change that file. It's yours. On top of that, the file is removed automatically when your process ends. How cool is that?

So what will happen? At first, not much. Eventually, errors will be logged to deleted log files that some files can't be found. If you try to run a new command, it will fail. Stopping a process will let it drop into limbo. Eventually, you'll up with a hanging system that can't be rebooted or shut down because those commands don't exist anymore.

Aaron Digulla

Posted 2010-08-23T13:45:56.377

Reputation: 6 035

Nice explanation of files and inodes – invert – 2010-08-23T14:09:11.743

so when an inode is in RAM and the system crashes, what happens? does that turn the file undeletable or are RAM-inodes treated differently? – Tobias Kienzler – 2010-08-23T14:15:03.450

Great explanation... but I was looking for the vid, although this probably will be useful sometime in the future in some way – xsznix – 2010-08-23T14:17:55.690

@Tobias: No, the space is reclaimed. This either happens because the node on disk has been marked as "for deletion"; then the next time the OS sees it, it will reclaim the space. Or a file system check will reclaim it since the structure is not referenced by anyone. When a new file is created, new blocks are allocated, a new "allocated blocks map" is written and then, last thing, the pointer to the "current allocate block map" is updated. As long as this didn't happen, the space is only allocated in RAM. Note: 50 years of development went into this file system. It is pretty good. – Aaron Digulla – 2010-08-23T14:32:15.973

0

You can test it for yourself, just install Linux in a virtual machine. Don't forget you will need to sudo or su for it to work.

Tobias Kienzler

Posted 2010-08-23T13:45:56.377

Reputation: 3 262

Asked: 2010-08-23T13:45:56.377

Viewed: 6 367 times

Active: 2010-08-23T14:25:13.210