I can't get my head around rm -rf / : after the kernel and /bin is deleted, how does rm maintain a run time stack, and communicate with the file system & hardware till it completes deletion? Is rm statically linked with all needed binaries and load the whole file system directory tree into memory when the command initiates?

  • 1
    file need by rm (mostly library and rm itself) are not deleted until rm ends. kernel and your bash login are kept in memory.
    – Archemar
    Apr 2, 2015 at 8:48
  • @Archemar: Just an assumption or is rm really programmed to do so? Is this a real use-case so that someone defines a requirement for this? Apr 2, 2015 at 15:02

2 Answers 2


It's due to the way filenames and file data are separate. When you delete a file you're just deleting a named reference (hard link) to the data, not the data itself. When all of the references are gone from the filesystem the kernel will go ahead and free up the data -- but only if no running processes currently have the file open. Until then the file is not really deleted, it's just not available via its filename any more.


No matter the kernel file is deleted, the kernel will keep working until shutdown, reboot or crash.

Similar happens with the running processes, the most common for ELF executables is all their dependencies (can see the particular corresponding files running ldd $(which rm)) are loaded from the filesystem to the virtual memory system, not freed from memory at least until all instances of that process are done. This is why hot replacement can be done on most executables and libraries.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .