How a file is deleted in ufs2?

[Oliver Fromme]

Tom Rhodes <trhodes at freebsd.org> wrote:
 > Kris Kennaway <kris at obsecurity.org> wrote:
 > > Tom Rhodes wrote:
 > > > Bruce Evans <bde at zeta.org.au> wrote:
 > > > > On Mon, 10 Apr 2006, Scott Long wrote:
 > > > > 
 > > > > > IOW, there is no easy way to undelete a file.
 > > > > 
 > > > > This is currently true, except in the rare case where undelete(2) works.
 > > > 
 > > > Oh, so it has worked for someone.  I always wonder why we have this
 > > > functionality when I have never been able to make it work.  Using
 > > > rm(1) that is.
 > > 
 > > DESCRIPTION
 > >      The undelete() system call attempts to recover the deleted file named by
 > >      path.  Currently, this works only when the named object is a whiteout in
 > >      a union file system. 
 > 
 > What it fails to do is tell users what a "whiteout" is.  At least
 > it was very unobvious to me while reading the manual page.

It should be obvious after reading the undelete(2) manpage
and the mount_unionfs(8) manpage (to which the former
refers).

Whiteouts are needed for UNIONFS mounts because the lower
layer of such a mount is read-only, so you cannot remove
files from it.

When you delete a file on a UNIONFS that exists in the
lower layer, a so-called whiteout is written to the upper
layer which causes the file in the lower layer to become
invisible and inaccessible (I think "ls -W" can be used
to see the whiteout itself).  In other words, such an
unlink operation does not really physically delete the
file.

The undelete(2) function removes the whiteout, so the
file becomes visible and accessible again.  See "rm -W".

Best regards
   Oliver

-- 
Oliver Fromme,  secnetix GmbH & Co. KG, Marktplatz 29, 85567 Grafing
Dienstleistungen mit Schwerpunkt FreeBSD: http://www.secnetix.de/bsd
Any opinions expressed in this message may be personal to the author
and may not necessarily reflect the opinions of secnetix in any way.

"In My Egoistical Opinion, most people's C programs should be indented
six feet downward and covered with dirt."
        -- Blair P. Houghton