Subj : Re: "Hiding" files under a mount point
To   : comp.os.linux
From : Thomas D. Shepard
Date : Thu Jul 29 2004 10:28 pm

On Fri, 30 Jul 2004 12:36:49 +1200, Allistar wrote:

> Hi all,
>   If I "hide" a file under a mount point, does that file still take up
> space?

Yes.
> 
>   I.e. I have a /spare directory. I copy a 20Mb file into it. I then
> mount /dev/hdb1 to /spare. Not surprisingly the file I just copied
> to /spare is no longer in /spare.

Sort of true. The file is still in the "spare" directory under the
filesystem that is mounted as "/" But the Kernel's attention is diverted
elsewhere when an application program asks for it, due to the
"overmount."
>
>   So what has happened to the file?

Nothing, in fact, if you open the file /spare in an application BEFORE
mounting over it, all references to it within the application still see
the original file, even after mounting over it. The file handle used by
application programs generally (file-system dependent, but probably
universally true) specifies the physical location of the data on the
physical hard drive, not the file path name.

["Fine print:" "physical location" may really be one or more firmware
layers removed from a true physical location.]
> 
>   It still appear to be there because when I unmount /spare, the file is
> visible again.
> 
>   Is there anything wrong with hiding files in this manner?

Hiding part of a file system by mounting over it is a weird thing to do,
but it is not too hard to imagine reasons why you might want to do it.

I can think of at least one reason for doing this that definitely
qualifies as "wrong." If a hacker breaks into a machine, he might use this
trick to hide whatever foul things he is doing.
>
> Allistar.

-- 
Thomas D. Shepard
Sorry, you can't email me.
(Email address is fake.)

.