Neal Murphy neal.p.murphy at alum.wpi.edu
Tue Jun 8 16:54:57 PDT 2010

On Tuesday 08 June 2010 19:04:21 Paul Rogers wrote:
> You can minimize the interval with "ln -sf bash /bin/sh".  Then it
> stomps on the old link to dash and there's no appreciable interval when
> there's no /bin/sh--but it's still not to be advised when it's a shell
> something in your tty branch might have run you're messing with!

This is somewhat true. The running shell will not be affected. Subsequent 
attempts to run that shell will fail.

It's been a long time since shell scripts were 'cached' in the filesystem such 
that editting a script would cause the running script to fail. And it's 
likely been nearly as long since an executing binary has been 'cached' on its 

Linux deletes the file from the FS, but keeps it available to all processes 
that have it open. It is deleted and forgotten when the last open FD is 
closed. So if you are running /bin/bash and you delete /bin/bash, your shell 
will continue to run until it closes the FD that has /bin/bash opened. Put 
differently, it is deleted from the FS directory and from the in-cache 
directory, but it cannot be deleted completely until the last process closes 
the FD. In a way, it is an orphan during the interim; it cannot be opened 
anew, but it can continue to be processed until the last FD that has it open 
is closed.

So, in the case that spawned this thread, the used could have continued to use 
his shell, albeit vey carefully and judiciously, until he exitted that shell. 
Even if he performed an 'rm -rf /', his shell would continue to run and he 
would continue to be able to use shell built-ins until he exitted that shell. 
At that point, only the root directory, '.' and '..' would be accessible.

Confused? Read up on tmpfs and how initramfs works. Hint: they both work with 
*no* filesystem structure, just directories and files with no backing store. 
They're one step removed from a RAM disk with a file structure layered on 
top. Were I to agree with software patents, this might be one of them. 
Another hint: it is what allows LiveCD Linux systems to run completely in 
RAM. Also read up on how file access works. When you open a file, you do not 
open the file on disk (normally). You ask the system to open the file for 
you. It creates an entry in the cache directory for that file, pages the file 
into memory over time, and allows you to access the file. When you close the 
file, it stays in cache until something else needs the memory more urgently.

More information about the lfs-support mailing list