2

So I'm running a freshly installed Debian 9.1 with KDE and some tool showed me that these files have been deleted but are still in use:

  • memfd:pulseaudio(pulsaudi)
  • memfd:xshmfence(Xorg)
  • /tmp/ibAbCdEf(mysqld)
  • [4 more of /tmp/ ones the above]

Note that this is a fresh install and I haven't downloaded any packages so far and only did small configurations. Why are these deleted but still in use? Can I fully delete them? Would this break anything - anybody else having these? And if they can or should be deleted: how?

Related, earlier question: "How to find & delete files which have been deleted from disk but whose file handle hasn't been closed in Debian?"

1

Using a filehandle on a deleted filename is a legitimate method of file access; this helps ensure that nothing else can (easily) access or otherwise interact with that file-that-is-now-only-held-open-by-the-filehandle. There is however nothing to distinguish this use-case from a oops-deleted-but-still-open bug without understanding the code that is generating those those temp files. In other words, deleted but open files can be totally legit.

The Perl File::Temp module for example unlinks the temporary file by default if only the filehandle (and not also the filename) is requested:

$ perl -MFile::Temp=tempfile -e 'my$fh=tempfile("qqqqXXXXXXXXXX");sleep 999' &
[1] 67001
$ lsof | grep qqqq
perl5.24 67001 jdoe 3u REG 1,2 0 65834304 /Users/jdoe/qqqq4mnuKXT3fS
$ file /Users/jdoe/qqqq4mnuKXT3fS
/Users/jdoe/qqqq4mnuKXT3fS: cannot open `/Users/jdoe/qqqq4mnuKXT3fS' (No such file or directory)
$ fg
perl -MFile::Temp=tempfi
^C
$

And now with a filename requested the file is not automagically unlinked:

$ perl -MFile::Temp=tempfile -e 'my($fh,$name)=tempfile("qqqqXXXXXXXXXX");sleep 999' &
[1] 67012
$ lsof | grep qqqq
perl5.24 67012 jdoe 3u REG 1,2 0 65834307 /Users/jdoe/qqqqEvy9FFVnLQ
$ file /Users/jdoe/qqqqEvy9FFVnLQ
/Users/jdoe/qqqqEvy9FFVnLQ: empty
$ 
  • There is also the O_TMPFILE flag to the Linux open system call that creates "pre-deleted" files, i.e. files that don't have a name in the file system, and are freed when they are closed. – Johan Myréen Aug 1 '17 at 19:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.