2

So I'm running a freshly installed Debian 9.1 with KDE and some tool showed me that these files have been deleted but are still in use:

  • memfd:pulseaudio(pulsaudi)
  • memfd:xshmfence(Xorg)
  • /tmp/ibAbCdEf(mysqld)
  • [4 more of /tmp/ ones the above]

Note that this is a fresh install and I haven't downloaded any packages so far and only did small configurations. Why are these deleted but still in use? Can I fully delete them? Would this break anything - anybody else having these? And if they can or should be deleted: how?

Related, earlier question: "How to find & delete files which have been deleted from disk but whose file handle hasn't been closed in Debian?"

mYnDstrEAm
  • 4,008
  • 13
  • 49
  • 108

1 Answers1

1

Using a filehandle on a deleted filename is a legitimate method of file access; this helps ensure that nothing else can (easily) access or otherwise interact with that file-that-is-now-only-held-open-by-the-filehandle. There is however nothing to distinguish this use-case from a oops-deleted-but-still-open bug without understanding the code that is generating those those temp files. In other words, deleted but open files can be totally legit.

The Perl File::Temp module for example unlinks the temporary file by default if only the filehandle (and not also the filename) is requested:

$ perl -MFile::Temp=tempfile -e 'my$fh=tempfile("qqqqXXXXXXXXXX");sleep 999' &
[1] 67001
$ lsof | grep qqqq
perl5.24 67001 jdoe 3u REG 1,2 0 65834304 /Users/jdoe/qqqq4mnuKXT3fS
$ file /Users/jdoe/qqqq4mnuKXT3fS
/Users/jdoe/qqqq4mnuKXT3fS: cannot open `/Users/jdoe/qqqq4mnuKXT3fS' (No such file or directory)
$ fg
perl -MFile::Temp=tempfi
^C
$

And now with a filename requested the file is not automagically unlinked:

$ perl -MFile::Temp=tempfile -e 'my($fh,$name)=tempfile("qqqqXXXXXXXXXX");sleep 999' &
[1] 67012
$ lsof | grep qqqq
perl5.24 67012 jdoe 3u REG 1,2 0 65834307 /Users/jdoe/qqqqEvy9FFVnLQ
$ file /Users/jdoe/qqqqEvy9FFVnLQ
/Users/jdoe/qqqqEvy9FFVnLQ: empty
$
thrig
  • 34,333
  • 3
  • 63
  • 84
  • 1
    There is also the O_TMPFILE flag to the Linux `open` system call that creates "pre-deleted" files, i.e. files that don't have a name in the file system, and are freed when they are closed. – Johan Myréen Aug 01 '17 at 19:44