5 ms·

Does the proc entry for a running process still link to the now-deleted file in that situation? If so, you might be able to save yourself from a running bash s

• linsomniac 5y ago
  Probably not if it was overwritten (": >/bin/bash") rather than removed and recreated ("rm -f /bin/bash; : >/bin/bash"). The former will cause all processes to see the empty file, the latter would leave processes with access to the old contents. In this case if you noticed and still had a shell, you could just copy another shell over ("cp /bin/sh /bin/bash"), to at least get back to probably able to login, until you could pull a copy from another machine or backups.
  • fulafel 5y ago
    In the wsgi case of replacing a regular file with an AF_UNIX socket, the destination would have needed to to be unlinked first - the bind() call will otherwise fail.
  • cyphar 5y ago
    On Linux you can't overwrite a binary that is currently being executed (you'll -ETXTBSY when you try to open it for writing, and truncate will also fail).
  • mijoharas 5y ago
    I was unaware of the first part of this, and decided to find a reference. This stack overflow answer[0] provides some detail on ETXTBUSY and the fact that writing directly writing to a running executable file will fail. (I had thought it would unlink the file like in the second case, simply because that's what I always see when recompiling something that's already running. This obviously uses the second method though). [0] https://unix.stackexchange.com/questions/187931/modifying-binary-during-execution https://unix.stackexchange.com/questions/187931/modifying-bi...