After posing this question, I'm kind of confused by the action of the linxu kernel.
First of all, I know how a process writes strings into a file: a process will obtain some buffer, the buffer can be written by the process, once the buffer is full or the process flushes the buffer, the content of the buffer will be written into the data block of the file. For example, in the program of C, when we
\n, it will flush the buffer.
Now, let's consider the case in the post above: a process has opened a file and is writing to it while the file is deleted by the comomand
As my understanding, the command
rm will unlink the file, meaning that its inode and its data blocks will be marked as
UNUSED. So we can't access it through the filename anymore. And if a process opens a file, the kernel will create a file descriptor to access it.
So if I'm right,
rm a file, to which a process is writing, won't cause any error of the process, because the process could access the file through the file descriptor. As someone mentioned in the comment of that post, we can still access the file through
Now I'm confused. If we can still access the file through
cat /proc/<pid>/fd/3 while the inode and the data have been marked as
UNUSED because of
rm, does it mean that the kernel will hold the whole file in RAM? If so, if the file is very huge, such as some log file, does it mean that lots of RAM will be used?
In a word, if a file isn't
rmed, a process can write things into the buffer and once the buffer is flushed, its content will be written into the data blocks of the file. But if a file has been
rmed, its data blocks will be marked as
UNUSED but a process can still write to it. Where is this "it"?