read() on a deleted file

[Fasihullah Askiri]

What I meant was, instead of deleting, I tried shredding the file. The
result was still consistent reads. However, after the mail from Alex,
I increased the filesize to see how much does it cache. Turns out on
my system, the read starts returning junk data [that written by shred]
after reading 1040 bytes correctly.

This is what I understand now, if I delete the file, the kernel
guarantees that the file data is preserved till the last reference (in
the form of an open filehandle maybe) lingers. If I shred the file,
the read succeeds till the buffering is done.

This, however sounds wierd to me, what we are essentially saying is
that the open/read might not return the latest data!!!! AFAIK the
buffer cache/inode cache that the kernel maintains is refreshed as
soon the file is modified. Please clarify.

Thanks again for the responses.



On Jan 3, 2008 6:16 PM, Hayim Shaul <hayim at iportent.com> wrote:
> On Thu, 2008-01-03 at 16:42 +0530, Fasihullah Askiri wrote:
> > Thanx for the response. That is why I tried shred-ding the file. I
> > believe that shred overwrites the file inode, if so, shred should have
> > led to failures of read() which is not the case. How does that happen?
> >
>
> What do you mean by re-writing?
> Do you mean opening a new file with the same name and writing into it?
>
> i don't think the new file (necessarily) gets the same inode as the file
> you deleted.
> More specifically, while the inode of the "deleted" file still exists,
> the new inode would most likely to be different.
>
>



-- 
Keep Running.... And Relish the run...
+Fasih