I got a weird hardlink at centos 6.5 vps server. It's man made, I assume, but I'm not the one who did it.

df tells some info.

[root@root]# df
Filesystem     1K-blocks      Used Available Use% Mounted on
/dev/simfs     209715200 128660820  81054380  62% /
none             4194304         4   4194300   1% /dev
none             4194304         0   4194304   0% /dev/shm
/dev/simfs     209715200 128660820  81054380  62% /var/www/username/data/www/test.site.biz/photo

ls -li tells nothing useful

[root@vz65646 test.site.biz]# ls -li
total 7952
79435160 drwxr-xr-x 2 someuser someuser 8130560 Oct 25 20:52 photo

Hardlinked folder is photo. By mistake I rm -rf test.site.biz which led to bad stuff happen. Namely, photo directory in other place went clean.

I assume restoring data is not possible. Yet, I'd like to figure out what happened out here so I won't repeat the same mistake twice.

Any hints are much appreciated.

  • this is a "bind mount". It is different from a hard link or symlink. – sourcejedi Oct 25 '16 at 18:02
  • @sourcejedi Thanks! Can you elucidate a bit? How can you detect it beforehand, for instance? – Yauheni Prakopchyk Oct 25 '16 at 18:35
  • 1
    1) quotes meaning that is the phrase to google. 2) it shows up in the mount list, hence why you see it in df... Actually, I don't recognize simfs; it could in theory be something different going on, but bind mounts would be consistent with what you describe. If you look through findmnt, if you see square brackets it is almost certainly a bind mount. But it's possible to do bind mounts which are not of a subdirectory, and they wouldn't have the square brackets. – sourcejedi Oct 25 '16 at 20:47
  • 1. Yeah I googled the matter of course. 2. I'm extremely thankful for your advice. Can you post you answer so that I can accept it? Direct hit, I say! BTW I asked the responsible programmer, and he thought he was doing symlinks. Bloody mess. – Yauheni Prakopchyk Oct 25 '16 at 21:23
  • i wasn't feeling like the effort to phrase a decent answer. +1 to the answer that mentions my name :p (but only because it's a good one). – sourcejedi Oct 26 '16 at 9:19

You have two mounted filesystems with similar characteristics: same device name, same disk usage. These are very likely to be, in fact, the same device. This can happen if you mount the same network filesystem in different locations, for example. Given that this is a local filesystem, as sourcejedi identified in a comment, this is very likely to be a bind mount, created by a command like mount --bind /origin /var/www/username/data/www/test.site.biz/photo.

If your system is recent enough, you can use findmnt to confirm that it's a bind mount. But anyhow, most filesystem types can't be mounted at the same time at different locations, so having the same device is proof enough that this is a bind mount.

A bind mount provides a view of a directory tree in a different location. In terms of accessing the files under the bind mount, it's similar to having a symbolic link in the tree, i.e. /var/www/username/data/www/test.site.biz/photo/somefile is the same file as /origin/somefile, as if /var/www/username/data/www/test.site.biz/photo was a symbolic link to /origin. But /var/www/username/data/www/test.site.biz/photo is not a symbolic link, it's a directory.

Since /var/www/username/data/www/test.site.biz/photo is a directory, a recursive traversal descends into it. So rm -rf deleted the files under /original, because /original and /var/www/username/data/www/test.site.biz/photo are the same directory that just happen to be shown in different locations.


Few things I figured on the matter:

  • mount --bind is a bad idea until you know exactly what you're doing. Better use symlinks.
  • It's fairly hard to detect mounts while working with folders. It's sorta server scope (not what you're thinking when moving folders around).
  • umount your_directory removes the binding but won't harm the original folder.
  • You can list all mounts via findmnt command. Bound mounts will have square brackets.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.