I deleted the executable, so why is it still running?

root@raspberrypi:/test# ls -la
total 11096
drwxrwxrwx  2 pi pi     4096 Mar 12 18:26 .
drwxrwxr-x 11 pi pi     4096 Feb 28 13:50 ..
-rwxrw-rw-  1 pi pi    12149 Feb 28 13:00 .cproject
-rwxrw-rw-  1 pi pi     3183 Mar 12 18:26 main.cpp
-rwxrw-rw-  1 pi pi     2169 Feb 28 14:28 main.cpp~
-rwxrw-rw-  1 pi pi     1862 Feb 28 13:20 original.cpp
-rwxrw-rw-  1 pi pi      984 Feb 28 13:09 .project
-rwxrw-rw-  1 pi pi 11323309 Jan 28 12:54 teatro.png
root@raspberrypi:/test# ./testedfb 


Some time later (after I tried to compile again, but there's an error, and the executable was not created) the behavior changed to:

root@raspberrypi:/test# ./testedfb 
bash: ./testedfb: No such file or directory

But I'm still curious; why was it was running?

--update (2):

Just happened again, and I did the test:

root@raspberrypi:/test# killall -9 testedfb
testedfb: no process found
root@raspberrypi:/test# ./testedfb 

And it still runs...

I'm on a Raspberry Pi's Bash.

--update (3):

It just happened the oposite now, the file was there, but it was not found:

root@raspberrypi:/test# ./testedfb 
bash: ./testedfb: No such file or directory
root@raspberrypi:/test# ls
main.cpp  main.cpp~  original.cpp  teatro.png  testedfb

(and on the next attempt it did run)

Maybe it's the NFS (this folder is mounted) that is too slow to update? (thanks @derobert for asking about the filesystem) - this would answer this second case, not the first one, as I cannot see the executable, but still I can execute it... (and looks like the process is not running too)

  • 1
    Which filesystem (ext2/3/4, btrfs, XFS, etc.) is this? – derobert Mar 12 '14 at 19:21
  • 2
    Of course, the executable could have been recreated from a different shell between the ls -la and the ./testedfb. – daniel kullmann Mar 12 '14 at 19:38
  • @derobert the filesystem is nfs4 ("test" folder is mounted with NFS) – Tom Brito Mar 13 '14 at 14:25
  • @derobert looks like your question is the answer... The NFS folder is not updating immediately when I create or delete a file from the source path... 'ls' command will update for a created file, but a deleted file can still be executed for some reason... – Tom Brito Mar 13 '14 at 14:52
  • Try which ./testedfb maybe which knows what ls doesn't. Or type ./testedfb to see what's bash actually doing. – orion Mar 13 '14 at 15:48

To run a program, it is opened by the kernel (or its interpreter). As long as it is running, the file is kept open.

Deleting a file that is open in Unix deletes its name from the disk, the file itself is only deleted when it is closed.

Add the above two, and you see that the running program continues to use its program file, and that one will be deleted only when the program exits.

| improve this answer | |
  • I'd say the same, but it appears, it was only run after the file was already gone... some black magic is at work here if the pasted sequence of commands is correct. – orion Mar 12 '14 at 19:29
  • That glosses over a lot of the detail... Bruce Ediger's explains the process a bit more accurately. – Matt Mar 12 '14 at 20:28
  • @mindthemonkey, right you are. +1 – vonbrand Mar 12 '14 at 20:31
  • Looks like the processes is not running, still I can execute it... check my second update. – Tom Brito Mar 13 '14 at 14:18

A program runs in memory, deleting it from the disc does normally not have the effect of stopping the program.

You need to explicitly kill the program with killall testedfb or if it doesn't react to that killall -9 testedfb.

| improve this answer | |
  • I believe it was not running (I did stop it before deleting). And I was able to start it after deleted... But, yes, it's possible that it was still running for some reason... – Tom Brito Mar 12 '14 at 18:45
  • This is true, but it's not what the question is asking. The program will keep running if deleted after it is started, but in this case the program was apparently deleted before it was started. Even if it still exists as a nameless file on disk, you shouldn't be able to access it via its no-longer-existing name. Did you try it? I did. – Nate Eldredge Mar 13 '14 at 0:16
  • This doesn't answer the question. – Bleeding Fingers Mar 13 '14 at 4:33
  • 1
    The program runs in memory, but not all of it may be in memory the system still relies on the file being on the disk (it is mmapped from there in memory), it's more that the file is not fully deleted while there's still a process with a file descriptor open on it (only the directory entry is removed preventing other processes to open it). – Stéphane Chazelas Mar 13 '14 at 5:16
  • Looks like the processes is not running, and still I can execute it... check my second update. – Tom Brito Mar 13 '14 at 14:20

Looks like it's a problem synchronizing the NFS folder.

If I create the executable on the NFS server, it will only be visible/executed locally after an ls command.

If I delete the executable on the NFS server, it still runs locally, event after an ls command showing that the file is not there. But if I delete the executable locally (on the same NFS folder) it'll not be found to execute again.

(to clear: by 'locally' I mean on the client raspberry terminal, not on the NFS server machine)

| improve this answer | |
  • 1
    Ah! So you were doing the delete from a different machine. Yeah. That'll do it. – derobert Mar 14 '14 at 10:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.