l i n u x - u s e r s - g r o u p - o f - d a v i s
Next Meeting:
July 7: Social gathering
Next Installfest:
Latest News:
Jun. 14: June LUGOD meeting cancelled
Page last updated:
2004 Aug 27 14:36

The following is an archive of a post made to our 'vox-tech mailing list' by one of its subscribers.

Report this post as spam:

(Enter your email address)
Re: [vox-tech] Identifying the directory that contains the currently running executable?
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [vox-tech] Identifying the directory that contains the currently running executable?

Ken Bloom said:
> I guess that solves the C program problem, because I can use getpid()
> to fill in the blank, and readlink(2) to find the elf executable.
> That is one wierd symlink. ME wrote in May
> (http://www.lugod.org/mailinglists/archives/vox-tech/2004-05/msg00247.html)
> about deleting the executable file, then recovering it from
> /proc/$PID/exe, so I had assumed it wasn't a symlink. Looking at it
> harder, symlinks can't usually point to deleted files [1], but this one
> can! You can recover the exe with cat, but not with cp. Really wierd.

Well, the /proc filesystem is not a "normal" filesystem, but is more like
a kind of collection of data stored in memory and "pointers" to other
("Normal" meaning it is not used so much to create files on a disk as we
think files exists on disks.)

I think that the behavior you see when accessing the symlink is one of two
properties or a combination of two properties:
1) A file is not actually deleted until all link to the file are destroyed
(not talking symlinks) and all processes that have opened that file, close
the file. (The file may not be listed as available for opening if all the
links to it are gone, but I do not think the file space is freed by the
filesystem until the last process with the file open closes it-- could be
wrong here.)
2) The file that is loaded into memory can effectively be written fromm
memory back out to a file. The thing that looks like a symlink in proc may
not actually be a conventional symlink.

I have not looked at proc in detail enough as of late to see how much each
of these play a role in grabbing copies of deleted applications from proc
if they are still running on the system.

vox-tech mailing list

LUGOD Group on LinkedIn
Sign up for LUGOD event announcements
Your email address:
LUGOD Group on Facebook
'Like' LUGOD on Facebook:

Hosting provided by:
Sunset Systems
Sunset Systems offers preconfigured Linux systems, remote system administration and custom software development.

LUGOD: Linux Users' Group of Davis
PO Box 2082, Davis, CA 95617
Contact Us

LUGOD is a 501(c)7 non-profit organization
based in Davis, California
and serving the Sacramento area.
"Linux" is a trademark of Linus Torvalds.

Sponsored in part by:
O'Reilly and Associates
For numerous book donations.