17

If I know the index node (inode) of a file, but I don't know its path (or any of its paths), is it possible to create a hard link to that inode directly?

I could find the file using sudo find / -inum 123546 and then create a hardlink, but that would be way too slow for my application.

N.B. I'm using an ext4 filesystem.

  • 1
    Closely related: removing or renaming a file via its inode (both of which are equally impossible to do directly). – Gilles Mar 12 at 9:53
23

AFAIK, not with the kernel API. If such an interface existed, it would have to be limited to the super-user as otherwise that would let anyone access files in directories they don't have search access to.

But you could use debugfs on the file system (once it's unmounted) to do it (assuming you have write access to the block device).

debugfs -w /dev/block/device

(replace /dev/block/device with the actual block device the file system resides in).

Then, at the prompt of debugfs, enter

stat <123>
(with the angle brackets, replacing 123 with the actual inode number) to check that the file exists (inode has a link count greater than 0) and is not a directory.

If all good, enter:

ln <123> path/to/newfile
to create the hardlink (note that the path is relative to the root of the file system). Followed by:

mi <123>
to increment the link count (press Enter for all the fields except the link count where you'll want to add 1 to the current value).

  • 6
    Such an interface would also have to check that the file has a nonzero link count, otherwise it would be possible to resurrect a deleted-but-still-open file, which IIRC was rejected because it violates kernel invariants. – Gilles Mar 12 at 9:53
  • 2
    @Gilles related: unix.stackexchange.com/a/499760/308316 – mosvy Mar 12 at 10:16
  • 1
    @PhilipCouling, the execute permission bit on a directory translates to search permission. I already said in directories then don't have search access to. – Stéphane Chazelas Mar 12 at 11:03
  • 3
    @OrangeDog, search permission is the terminology used by the POSIX standard. – Stéphane Chazelas Mar 12 at 14:28
  • 1
    @mosvy: That check can be removed from kernel. You have to patch up a couple of places in VFS for it to not hose itself though. I did it while working on my thesis years ago. – Joshua Mar 12 at 15:19
3

Depending on your use case, another approach could be to first collect all file candidates in one directory by hard linking it and then hard linking the files you are particularly interested in.

Such as

mkdir -pm 0700 by-inode/{0..999}
find <path> ! -type d -printf "%i/%p\0" |
  while IFS=/ read -rd '' i n; do
    ln "$n" "by-inode/$((i/1000))/$i"
  done

(assuming your inode numbers are all less than 1,000,000, create more directories if need be).

Afterwards, your inodes are grouped 1000-wise and collected in the by-inode/ tree. From there, you can link them as needed.

Note though that it means that deleting files under <path> will not reclaim the space because of that extra hard link.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.