Changes

After it the /foo/bar file will have its name removed from the filesystem tree (and from the on-disk data too), but since the file is still held by the process (this structure is explained in the article about [[dumping files]]), the blob with data itself is still there.

After it the /foo/bar file will have its name removed from the filesystem tree (and from the on-disk data too), but since the file is still held by the process (this structure is explained in the article about [[dumping files]]), the blob with data itself is still there.

There are two different sub-cases in this scenario. First, is when the file's number of hard links is zero, i.e. the /foo/bar name was the last (or the only it ever had) one removed. Another situation is when the link count is not zero, which means, that some other name for this file exists (hard link). In the latter case it's important to notice, that Linux VFS layer generally does ''not'' allow to find out this other name. Sometimes it's possible, but typically it's not.

There are two different sub-cases in this scenario. First, when the number of hard links associated with the file is zero, i.e. the /foo/bar name was the last one removed or the only it ever had. Another situation is when the link count is not zero. This means that some other name (hard link) for this file exists. In the latter case it is important to note that the Linux VFS layer typically does ''not'' allow to directly find out what the other name is.

=== Virtual filesystems ===

=== Virtual filesystems ===

For virtual filesystems like proc or sysfs there's another possibility for such files to appear. It's the removal of the object represented of a file on this FS. In particular, if we open some file in /proc/$pid and the respective task dies the path of the opened file would get removed, while the file itself would be still alive (though reporting ENOENT error on any attempts to read from one).

For virtual filesystems like proc or sysfs there is another possibility when such invisible files may appear. It's the removal of the object represented of a file on this FS. In particular, if we open some file in /proc/$pid and the respective task dies the path of the opened file would get removed, while the file itself would be still alive (though reporting ENOENT error on any attempts to read from one).

=== Name-less files ===

=== Name-less files ===

There's a third possibility for a file not to have a visible name. But this is another story, that has nothing to do with dumping opened files, this it's described in a [[How to open a file without open system call|another article]].

There is a third possibility for a file not to have a visible name but it has nothing to do with dumping opened files. This is described in [[How to open a file without open system call|another article]].

=== Overmounted files ===

=== Overmounted files ===

First, we [[dumping files|get the files]] from the target process via unix socket. Then for each of them get the file's name via /proc by calling <code>readlink</code> on the /proc/self/fd/$fd path. It's important to note, that we readlink ''self'' FD to get the file's name we can work with. Next we <code>fstat()</code> the respective self file descriptor.

First, we [[dumping files|get the files]] from the target process via unix socket. Then for each of them get the file's name via /proc by calling <code>readlink</code> on the /proc/self/fd/$fd path. It's important to note, that we readlink ''self'' FD to get the file's name we can work with. Next we <code>fstat()</code> the respective self file descriptor.

If the <code>st_nlink</code> field is zero, then the file is fully deleted from the system. Since no filesystems allow to create a name back for such files, we have no other choice other than get the file itself into images. So we generate a so called ''ghost file'' in the image directory and copy the file contents into it. Since the file is taken into the images, it would be good if the file size is not huge. By default CRIU dumps ghost files at most 1Mb in size. But with the option <code>--ghost-limit</code> this limit can be changed.

If the <code>st_nlink</code> field is zero, then the file is fully deleted from the system. Since no filesystems allow to recreate the name of such files, we have no other choice than to store the file itself into images. So we generate a so called ''ghost file'' in the image directory and copy the file contents into it. Since the content of the file is saved into images, CRIU has a limit for a maximum file size it can checkpoint. By default, this limit is set to 1Mb but it can be changed with the <code>--ghost-limit</code> option.

But what happens if the link count is not zero. Then we should check than the name we got from proc is the one with which we can see this file. So we call <code>stat()</code> on this name and compare <code>st_dev</code> and <code>st_inode</code> fields of it with those obtained from the fstat() call earlier. If they match the file is alive and we can just dump its name. If they don't the name we got references some other file and we fail the dump. This can be handled, but this situation is quite rare so we decided to implement support for it later.  

But what happens if the link count is not zero. Then we should check than the name we got from proc is the one with which we can see this file. So we call <code>stat()</code> on this name and compare <code>st_dev</code> and <code>st_inode</code> fields of it with those obtained from the fstat() call earlier. If they match the file is alive and we can just dump its name. If they don't the name we got references some other file and we fail the dump. This can be handled, but this situation is quite rare so we decided to implement support for it later.  

Please note that a file may have been opened by many removed names, and for each a link-remap name should point to the same file, so while dumping and restoring CRIU keeps track of those names to inode mappings.

Please note that a file may have been opened by many removed names, and for each a link-remap name should point to the same file, so while dumping and restoring CRIU keeps track of those names to inode mappings.

=== Virtual filesystems ===

=== Virtual filesystems ===