Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I deleted the executable, so why is it still running?

root@raspberrypi:/test# ls -la
total 11096
drwxrwxrwx  2 pi pi     4096 Mar 12 18:26 .
drwxrwxr-x 11 pi pi     4096 Feb 28 13:50 ..
-rwxrw-rw-  1 pi pi    12149 Feb 28 13:00 .cproject
-rwxrw-rw-  1 pi pi     3183 Mar 12 18:26 main.cpp
-rwxrw-rw-  1 pi pi     2169 Feb 28 14:28 main.cpp~
-rwxrw-rw-  1 pi pi     1862 Feb 28 13:20 original.cpp
-rwxrw-rw-  1 pi pi      984 Feb 28 13:09 .project
-rwxrw-rw-  1 pi pi 11323309 Jan 28 12:54 teatro.png
root@raspberrypi:/test# ./testedfb 
running...

--update:

Some time later (after I tried to compile again, but there's an error, and the executable was not created) the behavior changed to:

root@raspberrypi:/test# ./testedfb 
bash: ./testedfb: No such file or directory

But I'm still curious; why was it was running?

--update (2):

Just happened again, and I did the test:

root@raspberrypi:/test# killall -9 testedfb
testedfb: no process found
root@raspberrypi:/test# ./testedfb 
running...

And it still runs...

I'm on a Raspberry Pi's Bash.

--update (3):

It just happened the oposite now, the file was there, but it was not found:

root@raspberrypi:/test# ./testedfb 
bash: ./testedfb: No such file or directory
root@raspberrypi:/test# ls
main.cpp  main.cpp~  original.cpp  teatro.png  testedfb

(and on the next attempt it did run)

Maybe it's the NFS (this folder is mounted) that is too slow to update? (thanks @derobert for asking about the filesystem) - this would answer this second case, not the first one, as I cannot see the executable, but still I can execute it... (and looks like the process is not running too)

share|improve this question
1  
Which filesystem (ext2/3/4, btrfs, XFS, etc.) is this? –  derobert Mar 12 at 19:21
2  
Of course, the executable could have been recreated from a different shell between the ls -la and the ./testedfb. –  daniel kullmann Mar 12 at 19:38
    
@derobert the filesystem is nfs4 ("test" folder is mounted with NFS) –  Tom Brito Mar 13 at 14:25
    
@derobert looks like your question is the answer... The NFS folder is not updating immediately when I create or delete a file from the source path... 'ls' command will update for a created file, but a deleted file can still be executed for some reason... –  Tom Brito Mar 13 at 14:52
    
Try which ./testedfb maybe which knows what ls doesn't. Or type ./testedfb to see what's bash actually doing. –  orion Mar 13 at 15:48
show 1 more comment

3 Answers 3

To run a program, it is opened by the kernel (or its interpreter). As long as it is running, the file is kept open.

Deleting a file that is open in Unix deletes its name from the disk, the file itself is only deleted when it is closed.

Add the above two, and you see that the running program continues to use its program file, and that one will be deleted only when the program exits.

share|improve this answer
    
I'd say the same, but it appears, it was only run after the file was already gone... some black magic is at work here if the pasted sequence of commands is correct. –  orion Mar 12 at 19:29
    
That glosses over a lot of the detail... Bruce Ediger's explains the process a bit more accurately. –  mtm Mar 12 at 20:28
    
@mindthemonkey, right you are. +1 –  vonbrand Mar 12 at 20:31
    
Looks like the processes is not running, still I can execute it... check my second update. –  Tom Brito Mar 13 at 14:18
add comment

A program runs in memory, deleting it from the disc does normally not have the effect of stopping the program.

You need to explicitly kill the program with killall testedfb or if it doesn't react to that killall -9 testedfb.

share|improve this answer
    
I believe it was not running (I did stop it before deleting). And I was able to start it after deleted... But, yes, it's possible that it was still running for some reason... –  Tom Brito Mar 12 at 18:45
    
This is true, but it's not what the question is asking. The program will keep running if deleted after it is started, but in this case the program was apparently deleted before it was started. Even if it still exists as a nameless file on disk, you shouldn't be able to access it via its no-longer-existing name. Did you try it? I did. –  Nate Eldredge Mar 13 at 0:16
    
This doesn't answer the question. –  Bleeding Fingers Mar 13 at 4:33
1  
The program runs in memory, but not all of it may be in memory the system still relies on the file being on the disk (it is mmapped from there in memory), it's more that the file is not fully deleted while there's still a process with a file descriptor open on it (only the directory entry is removed preventing other processes to open it). –  Stéphane Chazelas Mar 13 at 5:16
    
Looks like the processes is not running, and still I can execute it... check my second update. –  Tom Brito Mar 13 at 14:20
add comment
up vote 3 down vote accepted

Looks like it's a problem synchronizing the NFS folder.

If I create the executable on the NFS server, it will only be visible/executed locally after an ls command.

If I delete the executable on the NFS server, it still runs locally, event after an ls command showing that the file is not there. But if I delete the executable locally (on the same NFS folder) it'll not be found to execute again.

(to clear: by 'locally' I mean on the client raspberry terminal, not on the NFS server machine)

share|improve this answer
1  
Ah! So you were doing the delete from a different machine. Yeah. That'll do it. –  derobert Mar 14 at 10:55
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.