I was reading the famous Unix Recovery Legend, and it occurred to me to wonder:
If I had a BusyBox shell open, and the BusyBox binary were itself deleted, would I still be able to use all the commands included in the BusyBox binary?
Clearly I wouldn't be able to use the BB version of those commands from another running shell such as
bash, since the BusyBox file itself would be unavailable for
bash to open and run. But from within the running instance of BusyBox, it appears to me there could be two methods by which BB would run a command:
- It could fork and exec a new instance of BusyBox, calling it using the appropriate name—and reading the BusyBox file from disk to do so.
- It could fork and perform some internal logic to run the specified command (for example, by running it as a function call).
If (1) is the way BusyBox works, I would expect that certain BusyBox-provided commands would become unavailable from within a running instance of BB after the BB binary were deleted.
If (2) is how it works, BusyBox could be used even for recovery of a system where BB itself had been deleted—provided there were still a running instance of BusyBox accessible.
Is this documented anywhere? If not, is there a way to safely test it?