When you runsudo rm -rf --no-preserve-root /Your system will delete every file, one by one. However, this also includes running processes and the operating system itself, eventually deleting rm. How is Linux able to continue to run if program files are being deleted the operating system is missing critical files?Additionally, how does rm continue to run if it's deleted?
How does Linux format itself while running?
rm
Despite its name, rm doesn't remove file. It actually unlinks -- removes directory entry referencing file. If there is still hard links for that file, data is kept intact. When program is executed, Kernel keeps a kind of hard links inside (they all are treated as same inode object), so data will be kept until last process closes unlinked file.Note how unlink system call is described:If that name was the last link to a file and no processes have the file open the file is deleted and the space it was using is made available for reuse. If the name was the last link to a file but any processes still have the file open the file will remain in existence until the last file descriptor referring to it is closed. For example:# cp /bin/sleep ./sleep# ln ./sleep ./sleep2# ./sleep 1000 &[1] 24399# rm ./sleepAt this point, data is still accessible through hardlink, and inode is still known to kernel as (task_struct)->mm->exe_file:# ls -lh ./sleep2-rwxr-xr-x 1 myaut users 31K Jun 17 23:10 ./sleep2# > ls -l /proc/24399/exe lrwxrwxrwx 1 myaut users 0 Jun 17 23:11 /proc/24399/exe -> /tmp/test/sleep (deleted)Even after deletion of second hardlink, data is kept (BTW, if you remove plug and your system loose power at this moment, you will get FS space leakage):# rm ./sleep2# ls -l /proc/24399/exe/proc/24399/exe -> /tmp/test/sleep (deleted)Now I kill process, and only at this moment disk (or tmpfs) space will be deallocated:# kill 24399