If I start a process and then delete the binary of it, I can still recover it from
$ cp `which sleep` . $ ./sleep 10m &  13728 $ rm sleep $ readlink /proc/13728/exe /tmp/sleep (deleted) $ cp /proc/13728/exe ./sleep-copy $ diff sleep-copy `which sleep` && echo not different not different $ stat /proc/13728/exe File: ‘/proc/13728/exe’ -> ‘/tmp/sleep (deleted)’ Size: 0 Blocks: 0 IO Block: 1024 symbolic link
On the other hand, if I make a symbolic link myself, delete the target and attempt to copy:
cp: cannot stat ‘sleep’: No such file or directory
/proc is an interface to the kernel. So does this symbolic link actually point to the copy loaded in memory, but with a more useful name? How does the
exe link work, exactly?