LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Security (https://www.linuxquestions.org/questions/linux-security-4/)
-   -   Is file on Ramdisk or Hard drive? (https://www.linuxquestions.org/questions/linux-security-4/is-file-on-ramdisk-or-hard-drive-4175547191/)

HardenedCriminal 07-03-2015 11:10 PM

Is file on Ramdisk or Hard drive?
 
I am putting some configuration files on a ramdisk (ramfs) to make sure they disappear on shutdown.

But I got to thinking if something went wrong and the files got copied to the mount point /mnt/tmpfs vs. the ramdisk, how can you tell?

Is the file virtual or not?

I did the umount -v /mnt/tmpfs and attempted to wipe the mount point directory & but it said access denied so I am guessing it really wasn't dismounted.

Got any ideas Experts?

rknichols 07-03-2015 11:29 PM

While the tmpfs filesysem is mounted, you can run "df /mnt/tmpfs? and see if the filesystem type in the first column is "tmpfs".

While the tmpfs is not mounted, you can just look in the /mnt/tmpfs directory and see if anything is there. Even while the tmpfs is mounted, there is still a way to see if any files are hidden under that mount point. Look at the manpage for the mount command and read the section about "The bind mounts."

Without knowing exactly what you did when you "attempted to wipe the mount point directory," it's hard to know what might result in "access denied" (or whatever the actual error message was).

suicidaleggroll 07-03-2015 11:43 PM

You can always run df on a file of interest to see what drive it lives on, eg: "df /mnt/tmpfs/tempfile". Or as rknichols suggested, you can run df on the directory itself to see were it lives.

HardenedCriminal 07-04-2015 07:47 AM

I wiped it with
rm /mnt/tmpfs -rf
(nothing is on the ramdrive but text files)

I never knew that about df for files. Thanks.

rknichols 07-04-2015 11:02 AM

Quote:

Originally Posted by HardenedCriminal (Post 5387072)
I wiped it with
rm /mnt/tmpfs -rf

The quickest way to wipe a tmpfs is to unmount it. POOF! Gone.
Quote:

I never knew that about df for files. Thanks.
Running df on any path gives a report for the filesystem on which that inode resides.

HardenedCriminal 07-04-2015 12:24 PM

But it didn't dismount from what I can tell with umount -v /mnt/tmpfs

It says unmounted but Squid still works and that is where the config files are.

Sorry I just did not pay closer attention, it is ramfs in the DF comment not a tmpfs.

rknichols 07-04-2015 07:18 PM

It won't unmount if some process has an open file or a current working directory there. If "umount -v" says the filesystem was unmounted but you are still seeing the files, then they must have been created by a process that was running in that mountpoint directory before the ramfs (or tmpfs) was mounted on it, and thus were never in the ramfs at all.

For the purposes of this discussion, ramfs and tmpfs are equivalent. The major difference is that tmpfs pages can be swapped out, whereas ramfs pages are locked in RAM. A ramdisk is different from either of those. A ramdisk simulates a fixed size hard disk in RAM, and you use mkfs to create an ordinary filesystem on it. df would show the type of whatever filesystem you created there, not "tmpfs" or "ramfs".

HardenedCriminal 07-04-2015 08:06 PM

What is odd about all this, is I did disable the program that makes and loads the ramdisk to find nothing in the /mnt/tmpfs/ folder on reboot. On my remote servers, I don't have this option.

I am to say the least confused. All I can figure is that all the files are cached into memory even though I can't find them once I umount the drive and squid still working. I think I will make a little program to run before Ramdisk is loaded to make sure the /mnt/tmpfs folder and its contents are deleted.

rknichols 07-04-2015 10:46 PM

When you remove a file, all that directly happens is that the directory link to that file is deleted. The file remains allocated in the filesystem until (a) the count of hard links to that file goes to zero, and (b) no process has the file open. Squid can continue running and using those deleted files. You won't be able to see them in the filesystem (no directory links), but you can still actually open the files by following the symlinks in /proc/{PID}/fd. You won't be able to unmount the filesystem (error EBUSY, "device is busy") while there is an open file there.

8bit 07-04-2015 10:54 PM

Quote:

Originally Posted by rknichols (Post 5387114)
The quickest way to wipe a tmpfs is to unmount it. POOF! Gone.
Running df on any path gives a report for the filesystem on which that inode resides.

+1 I agree close the file and just unmount it


All times are GMT -5. The time now is 08:17 AM.