LinuxQuestions.org
Welcome to the most active Linux Forum on the web.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 07-03-2015, 11:10 PM   #1
HardenedCriminal
Member
 
Registered: May 2015
Posts: 104

Rep: Reputation: Disabled
Is file on Ramdisk or Hard drive?


I am putting some configuration files on a ramdisk (ramfs) to make sure they disappear on shutdown.

But I got to thinking if something went wrong and the files got copied to the mount point /mnt/tmpfs vs. the ramdisk, how can you tell?

Is the file virtual or not?

I did the umount -v /mnt/tmpfs and attempted to wipe the mount point directory & but it said access denied so I am guessing it really wasn't dismounted.

Got any ideas Experts?

Last edited by HardenedCriminal; 07-04-2015 at 12:25 PM. Reason: It is a RAMFS ramdisk not a tmpfs.
 
Old 07-03-2015, 11:29 PM   #2
rknichols
Senior Member
 
Registered: Aug 2009
Distribution: Rocky Linux
Posts: 4,783

Rep: Reputation: 2214Reputation: 2214Reputation: 2214Reputation: 2214Reputation: 2214Reputation: 2214Reputation: 2214Reputation: 2214Reputation: 2214Reputation: 2214Reputation: 2214
While the tmpfs filesysem is mounted, you can run "df /mnt/tmpfs? and see if the filesystem type in the first column is "tmpfs".

While the tmpfs is not mounted, you can just look in the /mnt/tmpfs directory and see if anything is there. Even while the tmpfs is mounted, there is still a way to see if any files are hidden under that mount point. Look at the manpage for the mount command and read the section about "The bind mounts."

Without knowing exactly what you did when you "attempted to wipe the mount point directory," it's hard to know what might result in "access denied" (or whatever the actual error message was).
 
1 members found this post helpful.
Old 07-03-2015, 11:43 PM   #3
suicidaleggroll
LQ Guru
 
Registered: Nov 2010
Location: Colorado
Distribution: OpenSUSE, CentOS
Posts: 5,573

Rep: Reputation: 2142Reputation: 2142Reputation: 2142Reputation: 2142Reputation: 2142Reputation: 2142Reputation: 2142Reputation: 2142Reputation: 2142Reputation: 2142Reputation: 2142
You can always run df on a file of interest to see what drive it lives on, eg: "df /mnt/tmpfs/tempfile". Or as rknichols suggested, you can run df on the directory itself to see were it lives.
 
1 members found this post helpful.
Old 07-04-2015, 07:47 AM   #4
HardenedCriminal
Member
 
Registered: May 2015
Posts: 104

Original Poster
Rep: Reputation: Disabled
I wiped it with
rm /mnt/tmpfs -rf
(nothing is on the ramdrive but text files)

I never knew that about df for files. Thanks.
 
Old 07-04-2015, 11:02 AM   #5
rknichols
Senior Member
 
Registered: Aug 2009
Distribution: Rocky Linux
Posts: 4,783

Rep: Reputation: 2214Reputation: 2214Reputation: 2214Reputation: 2214Reputation: 2214Reputation: 2214Reputation: 2214Reputation: 2214Reputation: 2214Reputation: 2214Reputation: 2214
Quote:
Originally Posted by HardenedCriminal View Post
I wiped it with
rm /mnt/tmpfs -rf
The quickest way to wipe a tmpfs is to unmount it. POOF! Gone.
Quote:
I never knew that about df for files. Thanks.
Running df on any path gives a report for the filesystem on which that inode resides.
 
1 members found this post helpful.
Old 07-04-2015, 12:24 PM   #6
HardenedCriminal
Member
 
Registered: May 2015
Posts: 104

Original Poster
Rep: Reputation: Disabled
But it didn't dismount from what I can tell with umount -v /mnt/tmpfs

It says unmounted but Squid still works and that is where the config files are.

Sorry I just did not pay closer attention, it is ramfs in the DF comment not a tmpfs.

Last edited by HardenedCriminal; 07-04-2015 at 12:43 PM.
 
Old 07-04-2015, 07:18 PM   #7
rknichols
Senior Member
 
Registered: Aug 2009
Distribution: Rocky Linux
Posts: 4,783

Rep: Reputation: 2214Reputation: 2214Reputation: 2214Reputation: 2214Reputation: 2214Reputation: 2214Reputation: 2214Reputation: 2214Reputation: 2214Reputation: 2214Reputation: 2214
It won't unmount if some process has an open file or a current working directory there. If "umount -v" says the filesystem was unmounted but you are still seeing the files, then they must have been created by a process that was running in that mountpoint directory before the ramfs (or tmpfs) was mounted on it, and thus were never in the ramfs at all.

For the purposes of this discussion, ramfs and tmpfs are equivalent. The major difference is that tmpfs pages can be swapped out, whereas ramfs pages are locked in RAM. A ramdisk is different from either of those. A ramdisk simulates a fixed size hard disk in RAM, and you use mkfs to create an ordinary filesystem on it. df would show the type of whatever filesystem you created there, not "tmpfs" or "ramfs".
 
1 members found this post helpful.
Old 07-04-2015, 08:06 PM   #8
HardenedCriminal
Member
 
Registered: May 2015
Posts: 104

Original Poster
Rep: Reputation: Disabled
What is odd about all this, is I did disable the program that makes and loads the ramdisk to find nothing in the /mnt/tmpfs/ folder on reboot. On my remote servers, I don't have this option.

I am to say the least confused. All I can figure is that all the files are cached into memory even though I can't find them once I umount the drive and squid still working. I think I will make a little program to run before Ramdisk is loaded to make sure the /mnt/tmpfs folder and its contents are deleted.

Last edited by HardenedCriminal; 07-04-2015 at 08:07 PM.
 
Old 07-04-2015, 10:46 PM   #9
rknichols
Senior Member
 
Registered: Aug 2009
Distribution: Rocky Linux
Posts: 4,783

Rep: Reputation: 2214Reputation: 2214Reputation: 2214Reputation: 2214Reputation: 2214Reputation: 2214Reputation: 2214Reputation: 2214Reputation: 2214Reputation: 2214Reputation: 2214
When you remove a file, all that directly happens is that the directory link to that file is deleted. The file remains allocated in the filesystem until (a) the count of hard links to that file goes to zero, and (b) no process has the file open. Squid can continue running and using those deleted files. You won't be able to see them in the filesystem (no directory links), but you can still actually open the files by following the symlinks in /proc/{PID}/fd. You won't be able to unmount the filesystem (error EBUSY, "device is busy") while there is an open file there.
 
1 members found this post helpful.
Old 07-04-2015, 10:54 PM   #10
8bit
LQ Newbie
 
Registered: Jul 2015
Posts: 8

Rep: Reputation: Disabled
Quote:
Originally Posted by rknichols View Post
The quickest way to wipe a tmpfs is to unmount it. POOF! Gone.
Running df on any path gives a report for the filesystem on which that inode resides.
+1 I agree close the file and just unmount it
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
UNetBootin isn't creating bootable flash drive from file on hard drive. glenellynboy Linux - Newbie 44 09-30-2011 05:28 PM
What hard drive file system should be used for network drive? Zinake Linux - Server 5 01-23-2008 06:58 AM
Running Linux from Ramdisk w/o Hard Drive epitome Linux - Laptop and Netbook 4 11-24-2007 09:19 PM
File Server Hard Drive Grook93 Linux - Hardware 2 09-07-2006 11:15 PM
Reiser file system / Hard Disk/ Hard Drive Problems Oxyacetylene Linux - Software 4 10-10-2005 02:24 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 02:02 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration