20

If I know the index node (inode) of a file, but I don't know its path (or any of its paths), is it possible to create a hard link to that inode directly?

I could find the file using sudo find / -inum 123546 and then create a hardlink, but that would be way too slow for my application.

N.B. I'm using an ext4 filesystem.

Improve this question
1

2 Answers 2

Reset to default
26

AFAIK, not with the kernel API. If such an interface existed, it would have to be limited to the super-user as otherwise that would let anyone access files in directories they don't have search access to.

But you could use debugfs on the file system (once it's unmounted) to do it (assuming you have write access to the block device).

debugfs -w /dev/block/device

(replace /dev/block/device with the actual block device the file system resides in).

Then, at the prompt of debugfs, enter

stat <123>
(with the angle brackets, replacing 123 with the actual inode number) to check that the file exists (inode has a link count greater than 0) and is not a directory.

If all good, enter:

ln <123> path/to/newfile
to create the hardlink (note that the path is relative to the root of the file system). Followed by:

mi <123>
to increment the link count (press Enter for all the fields except the link count where you'll want to add 1 to the current value).

Improve this answer
7
  • 6
    Such an interface would also have to check that the file has a nonzero link count, otherwise it would be possible to resurrect a deleted-but-still-open file, which IIRC was rejected because it violates kernel invariants.
    – Gilles 'SO- stop being evil'
    Mar 12, 2019 at 9:53
  • 2
    @Gilles related: unix.stackexchange.com/a/499760/308316
    – user313992
    Mar 12, 2019 at 10:16
  • 1
    @PhilipCouling, the execute permission bit on a directory translates to search permission. I already said in directories then don't have search access to.
    – Stéphane Chazelas
    Mar 12, 2019 at 11:03
  • 3
    @OrangeDog, search permission is the terminology used by the POSIX standard.
    – Stéphane Chazelas
    Mar 12, 2019 at 14:28
  • 1
    @mosvy: That check can be removed from kernel. You have to patch up a couple of places in VFS for it to not hose itself though. I did it while working on my thesis years ago.
    – Joshua
    Mar 12, 2019 at 15:19
3

Depending on your use case, another approach could be to first collect all file candidates in one directory by hard linking it and then hard linking the files you are particularly interested in.

Such as 

mkdir -pm 0700 by-inode/{0..999}
find <path> ! -type d -printf "%i/%p\0" |
  while IFS=/ read -rd '' i n; do
    ln "$n" "by-inode/$((i/1000))/$i"
  done

(assuming your inode numbers are all less than 1,000,000, create more directories if need be).

Afterwards, your inodes are grouped 1000-wise and collected in the by-inode/ tree. From there, you can link them as needed.

Note though that it means that deleting files under <path> will not reclaim the space because of that extra hard link.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .