On 2026-01-13 at 02:57, [email protected] wrote: > On Mon, Jan 12, 2026 at 08:03:39PM -0500, Greg Wooledge wrote: > > [...] > >> This left me with the dhcpcd-base package installed, >> isc-dhcp-client in the "rc" state, and a dhclient process still >> running(!). I didn't even think that was possible on Linux -- for >> a process to continue running after its program file on disk has >> been unlinked. > > I remember it always was "normal" on Unices (I even remember poking > fun at the poor Windows sods who couldn't pull off that trick). The > background is that you just remove the directory entry (the file > still exists as long as it is referenced, i.e. at least while the > process runs; actually, on Linux, with its proc file system you even > might revive it by looking through /proc/<PID>, I think).
Yep - this has been part of my understanding of the key differences between *nix and Windows/etc. filesystem semantics. In particular, this is what makes it possible for files (including important system files, et cetera) to be modified or deleted while they are still in use - and, thereby, the reason for the fact that on *nix systems, software (including the OS) can be upgraded without requiring a reboot, and Windows systems it very often cannot. My understanding is that the file is not gone (released by the filesystem, its resource consumption freed for use by other things) as long as there is still one reference to it, and *references by open file descriptors count*. If that understanding is correct, then in theory, you could have a program which opens a file, waits indefinitely to see if it gets deleted, and if it ever does, creates it again (whether under the same name/path or under another) - thereby ensuring that as long as that program stays running, the file sticks around in some respect, including that the resources are not freed up. I'm not sure there'd be much use for such a setup other than by malware, but I'm reasonably confident that it would in fact be possible. (I have additional thoughts about edge cases of that odd edge case, some of which might mitigate the potential malware side of that and some of which might exacerbate it, but they are not coming readily into express-able words.) > Now trying to *edit the executable file in place* might get you a > -ETXTBSY (Text file busy). Another kettle of fish. I don't think I've actually seen a reference to this (signal?) code before. -- The Wanderer The reasonable man adapts himself to the world; the unreasonable one persists in trying to adapt the world to himself. Therefore all progress depends on the unreasonable man. -- George Bernard Shaw
signature.asc
Description: OpenPGP digital signature
