Will overwriting to an executable file affect a process which is running the original executable file?

Question

When a executable file is run in a process, if the executable file is overwritten, or deleted and then recreated by reinstallation, will the process rerun the new executable file?

Does the answer to the question depend on

• whether the executable is run as a service/daemon in the process or not?

• the operation system, e.g. Ubuntu, Windows, ...?

• whether the reinstallation is from an installer file (e.g. deb file on Ubuntu, msi on Windows) or from building its source code?

Here are some examples:

• In Ubuntu, when a process runs an executable file, and when I overwrite the executable file, by manually reinstallation via configure, make, and make install on its source code, the process still continues to run the original executable file, instead of the new executable file.

• I heard that in Windwos 10, when a process runs an executable file as a service, if we reinstall the executable file via its msi installer file, then the service process will restart to run the new executable file.

Thanks.

Answer 1

I don't know the answer to all your (sub)questions, especially when it comes to Windows services. Still I can explain the general difference between Windows and Linux behavior.

I understand "overwriting" as writing to already existing file. The alternative is deleting the old file and creating a new file with the same name. I would expect all installers to do it the latter way because overwriting a running code is a trouble wish (and an alarm bell for antivirus etc.).

So technically it's hardly ever "overwriting". So what about deleting and creating anew?

Inode-based filesystems, like ext family in Linux, allow to delete a file which is in use. Windows with NTFS or FAT doesn't behave like this. Read more here: What is Linux doing differently that allows me to remove/replace files where Windows would complain the file is currently in use?

An installer in Windows may try to gracefully (or not) stop processes that use certain file, if it's aware of them. Otherwise it couldn't do its job because the filesystem would deny file deletion. Linux installers don't need to care about it in general.

This behavior in Linux is so useful that we tend to emulate it for filesystems which don't support it by themselves. Read my answer to another question ("the context" section) for some insight.

---

will the process rerun the new executable file?

In general: no. But since the process must be terminated in Windows, the installer (or a watchdog of some kind) may "feel obligated" to resurrect it – of course with the new executable because the old one is already deleted. In Linux the process can run the original executable as if nothing happened. Nevertheless some installers in Linux may restart processes (e.g. daemons) to force running the new executable.

At the end let's see what happens when the installer is lazy and does only the tasks that are necessary to replace the executable with the new one. In Windows it has to kill the process, then it replaces the file; the process is no more. In Linux the installer simply replaces the file and the process survives.