5

In my program (on Mac OS X), I opened the file using following code.

 int fd;
 fd = open(filename, O_RDWR);

Program to delete the file is as follows:

unlink(filename);

In my case, I have same file which is opened and deleted. I observed the following:

  1. After opening the file, I can delete it using this program and even by using rm command.
  2. After deleting the file, read and write operations are working on the file without any problem.

I would like to know the reason behind this. How to prevent rm command or unlink(2) system call from deleting the file which is being opened?

5
  • 1
    Isn't that the expected behaviour of unlink(2)? Did you check the documentation? "If one or more process have the file open when the last link is removed, the link is removed, but the removal of the file is delayed until all references to it have been closed."
    – Carl Norum
    Oct 18, 2013 at 4:55
  • @CarlNorum: I checked unlink(2). It is expected behaviour. But why read and write operation after unlink(2) are successful? Oct 18, 2013 at 4:57
  • Just like the docs say, the file isn't removed until the references have been closed. The file still exists, so read and write should continue working, right?
    – Carl Norum
    Oct 18, 2013 at 4:58
  • But in Finder, I cannot find the file. Even ls is not listing the file. Oct 18, 2013 at 5:00
  • Sure, the link has been removed, so there's no reference in the filesystem for other programs to find it.
    – Carl Norum
    Oct 18, 2013 at 5:01

4 Answers 4

8

You can't stop unlink(2) from unlinking a file which it has permission to unlink (i.e. it has write access to the directory).

unlink is not called unlink because nobody could think of a better name. It's called that because that is what it does; it unlinks the file from the directory. (A directory is just a collection of links; i.e. it associates names with the location of the corresponding data.) It does not delete the file; the file is garbage collected by the filesystem when there are no longer any links to it.

Open file descriptors are not the only way to keep links to files. Another, quite common, way is to use the link(1) command without the -s option. This creates "hard" links. If a file has several hard links, then removing one of the links (with unlink(2)) does just that -- it removes one of the links.

The rm command has a possibly more confusing name, but it, too, only removes the name, not the file. The file exists as long as someone has a link to it, including a running process.

1
  • +1, but suggest a minor edit. In the final paragraph, change "removes the name of the file" to "removes one name of the file" (or something like that). This should help clarify that a pathname is not a file, and any given file may have multiple paths that refer to it. (Very hard to avoid using the word "link" instead of "refer". Not sure which is clearer.) Oct 18, 2013 at 14:40
4

First, rm command is calling unlink(2)

Then, unlinking an opened file is a normal thing to do on Linux or others Unixes (e.g. MacOSX). It is the canonical way to get temporary files (like tmpfile(3) probably does).

You should understand what inodes are, and realize that a file is not its name or file path, but essentially an inode. A file can have zero, one, or several file paths or names (one can add more with the link(2) syscall, provided all the names sit in the same filesystem). Directory entries associate names to inodes.

So there is no (POSIX-ly portable) way to prohibit I/O on open-ed files without any names. For some opened file, the kernel has reference counters to its inode, and keep that inode till all processes having open(2)-ed it did close(2) it or have terminated.

See also inode(7) and credentials(7).

1

It's a normal Situation in UNIX SYSTEM. when you rm or unlink an opened file. UNIX system just mark a flag , and won't really delete the file desception. until the file is closed. and it will be really deleted in the file system.

It's protection to help the daemon work fine.

2
  • Thanks for providing the reasoning. How to prevent unlink(2) and rm from deleting the opened file? Oct 18, 2013 at 5:05
  • 1
    use chmod and chown to limit user and group to write the file
    – Chair
    Oct 18, 2013 at 5:19
1

A link is a name associated to some file (a file is basically unamed). Note that a file could have different names (try ln).

unlink() removes one of this association to a file. If you remove the last link to a file, this just makes you unable to access the file by a name. But, this doesn't mean that the file is unusable, as a file could have been opened and his currently read/written by some application.

A file is removed if and only if : - there is no link on it - it is not currently opened by any application

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.