In Unix/Linux, a removed file only disappears when the last file descriptor to it is gone. As long as the file /usr/bin/rm is still opened by a process (and it is, because it is running) it will not actually be deleted from disk from the perspective of that process.
This also why removing a log file that’s actively being written to doesn’t clear up filesystem space, and why it’s more effective to truncate it instead. ( e.g. Run > /var/log/myhugeactivelogfile.log instead of rm /var/log/myhugeactivelogfile.log)
Sometimes you can even use this to recover an accidentally deleted file, if it’s still held open in a process. You can go to /proc/$PID/fd, where $PID is the process ID of the process holding the file open, and find all the file descriptors it has in use, and then copy the lost content from there.
In Unix/Linux, a removed file only disappears when the last file descriptor to it is gone. As long as the file
/usr/bin/rmis still opened by a process (and it is, because it is running) it will not actually be deleted from disk from the perspective of that process.This also why removing a log file that’s actively being written to doesn’t clear up filesystem space, and why it’s more effective to truncate it instead. ( e.g. Run
> /var/log/myhugeactivelogfile.loginstead ofrm /var/log/myhugeactivelogfile.log)Sometimes you can even use this to recover an accidentally deleted file, if it’s still held open in a process. You can go to
/proc/$PID/fd, where$PIDis the process ID of the process holding the file open, and find all the file descriptors it has in use, and then copy the lost content from there.