Linux/Unix/File Systems: Inodes (Part 2) – File Level Inode Information And Removal
Inodes “Part 1″ went into locating filesystem level inode information. Here we will move from the main filesystem to the individual file. Besides reviewing how the inode record reflects permissions modification using chown, file removal based on inode number will be covered.
Create a test file
user01@testsrv:~$ touch testfile
Below, “ls” is used to display the inode number (2009418) of the test file
user01@testsrv:~$ ls -i /home/user01/testfile 2009418 /home/user01/testfile Check the inode record for the newly created empty file
user01@testsrv:~$ stat /home/user01/testfile File: `/home/user01/testfile' Size: 0 Blocks: 0 IO Block: 4096 regular empty file Device: fe01h/65025d Inode: 2009418 Links: 1 Access: (0644/-rw-r--r--) Uid: ( 1000/user01) Gid: ( 1000/user01) Access: 2009-04-10 17:52:59.000000000 -0400 Modify: 2009-04-10 17:52:58.000000000 -0400 Change: 2009-04-10 17:52:58.000000000 -0400
In the following example, a file is being checked that is solely owned by the root user
user01@testsrv:~$ ls -la /home/user01/w2k3-2.iso -rw-r--r-- 1 root root 171769856 2009-03-28 13:15 /home/user01/w2k3-2.iso
Review the root owned ISO file inode information. The user and group ownership is referenced as Uid and Gid respectively
user01@testsrv:~$ stat /home/user01/w2k3-2.iso File: `/home/user01/w2k3-2.iso' Size: 171769856 Blocks: 335824 IO Block: 4096 regular file Device: fe01h/65025d Inode: 2009538 Links: 1 Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root) Access: 2009-03-28 13:11:44.000000000 -0400 Modify: 2009-03-28 13:15:33.000000000 -0400 Change: 2009-03-28 13:15:33.000000000 -0400
Change the permissions of the ISO file via the root user (current owner of the file)
root@testsrv:/home/user01# chown user01:user01 /home/user01/w2k3-2.iso
Re-check tje ISO file permission from the initial user (user01) via the ls command
user01@testsrv:~$ ls -la /home/user01/w2k3-2.iso -rw-r--r-- 1 user01 user01 171769856 2009-03-28 13:15 /home/user01/w2k3-2.iso
Re-stat the ISO file to view the changes in the inode record. As you can see, the file ownership is now set to user user01 and group user01
user01@testsrv:~$ stat /home/user01/w2k3-2.iso File: `/home/user01/w2k3-2.iso' Size: 171769856 Blocks: 335824 IO Block: 4096 regular file Device: fe01h/65025d Inode: 2009538 Links: 1 Access: (0644/-rw-r--r--) Uid: ( 1000/user01) Gid: ( 1000/user01) Access: 2009-03-28 13:11:44.000000000 -0400 Modify: 2009-03-28 13:15:33.000000000 -0400 Change: 2009-04-10 17:57:35.000000000 -0400
For the next example user01 is kept as the user, but the group is changed to ‘admin’. Since the current user user01 now has full rights to the file, it can be done from that account
user01@testsrv:~$ chown :admin /home/user01/w2k3-2.iso
Re-stat the file once more to see if the group (Gid) has been changed in the inode for this file
user01@testsrv:~$ stat /home/user01/w2k3-2.iso File: `/home/user01/w2k3-2.iso' Size: 171769856 Blocks: 335824 IO Block: 4096 regular file Device: fe01h/65025d Inode: 2009538 Links: 1 Access: (0644/-rw-r--r--) Uid: ( 1000/user01) Gid: ( 119/ admin) Access: 2009-03-28 13:11:44.000000000 -0400 Modify: 2009-03-28 13:15:33.000000000 -0400 Change: 2009-04-10 18:00:32.000000000 -0400
Now with the basic understanding of finding an retrieving inode numbers and information, we will proceed to removing files using the “rm” command. Specifically, the following will detail how to remove a file by referencing the inode number. All of which is done by using “find” and passing the results to “rm”.
There have only been a few occasions that I can remember where I have needed to know the following, but it is worth knowing! The main benefit is when a file has been created with a control character in the name
Create a test file
user01@testsrv:/tmp/testdir$ touch '`' user01@testsrv:/tmp/testdir$ ls `
Try to remove the file without enclosing the “`” filename
user01@testsrv:/tmp/testdir$ rm ` >
Above you can see that the command did not work. Instead it dropped to the “>” sub-prompt
Locate the inode number for the “`” file. Tab based auto-complete does wonders escaping the special character filename on the command line
user01@testsrv:/tmp/testdir$ ls -i /tmp/testdir/` 1163285 /tmp/testdir/`
Now that the inode number is known, the “find” command can be used to retrieve the filename associated with it
user01@testsrv:/tmp/testdir$ find /tmp -inum 1163285 /tmp/testdir/`
Putting it all together, we can remove the file passing the “find” results to “rm”. Below uses a command line pipe (“|”) and xargs to accomplish this
user01@testsrv:/tmp/testdir$ find /tmp -inum 1163285 | xargs rm
Verify the file has been removed
user01@testsrv:/tmp/testdir$ ls /tmp/testdir/
The same can be accomplished via find commands built-in exec feature
user01@testsrv:/tmp/testdir$ find /tmp -inum 1163285 -exec rm {} ;
In my opinion, the best way to remove a file via the inode number is as follows
user01@testsrv:~$ find /tmp -inum 1163285 -exec rm -i {} ;
rm: remove regular empty file `/tmp/testdir/`'? y
Specifying “-i” after rm makes the user verify the file to be removed.
Notes: There are other ways around removing files with certain characters. In this chase, the “`” file could have been removed with:
user01@testsrv:/tmp/testdir$ rm /tmp/testdir/`
If any information in this post is found to be outdated, incorrect, useful, or needs further detail, please leave a comment or email me.
~ by Kevin Goodman on April 13, 2009.
Posted in Filesystems, Linux, Monitoring, Uncategorized
Tags: centos, chown, exec, find, gid, inode, inodes, LinkedIn, Linux, permissions, redhat, rm, ubuntu, uid, unix, xargs

Leave a Reply