Understanding of the Inode under Linux

0x01 What is Inode

The file is stored on the hard disk, the minimum storage unit of the hard disk is called "Sector" (Sector), each sector is stored 512 bytes;

When the operating system reads the hard disk, it does not read from one sector to the next, so it is inefficient, but reads multiple sectors at once, i.e. reads a block at a time. This sector consists of a block is the smallest unit of file storage, the size of the block, the most common is 4kb, that is, 8 consecutive sector to form a block;

File data is stored in blocks, obviously, you must also find a place to store the file's meta-information, such as the creator of the file, the date the file was created, the size of the file, and so on. This area of storing file meta information is called Inode, and the Chinese name is "Index node".

Contents of the 0x02 inode

The inode contains the meta-information for the file, with the following content:

(1) Number of bytes in the file

(2) UserID of the owner of the document

(3) GroupID of documents

(4) Read, write, and execute permissions for the file

(5) The amount of time stamp of the document, there are three: CTime refers to the time of the inode last change, mtime refers to the time of the file content last change, atime refers to the time the file was last opened

(6) Number of links, that is, how many filenames point to this inode

(7) Location of file data block

You can use the Stat command to view inode information for a file:

　　

In summary, all file information except the filename is stored in the inode.

Size of the 0x03 inode

The inode also consumes hard disk space, and when the hard disk is formatted, the operating system automatically divides the hard disk into two regions, one is the data area, the file data is stored, the other is the Inode (inode table), and the information contained in the inode is stored.

The size of each inode node is typically 128 bytes or 256 bytes. The total number of inode nodes, given at the time of formatting, is usually set to one inode per 1KB or 2KB each. Assuming that the size of each inode node in a 1GB hard disk is 128 bytes, and one inode is set per 1KB, the Inode table will be about 128MB in size, accounting for 12.8% of the entire drive.

You can use the DF command to view the total number of inode per hard disk partition and the quantity that is already in use.

　　

To see the size of each inode node, you can use the following command:

　　

Because each file must have an inode, it is possible that the inode has been exhausted, but the hard disk is not full, and you cannot create a new file on the hard disk.

0x04 inode Number

Each inode has a number, and the operating system uses Inode numbers to identify different files.

It is worth repeating that the Unix/linux system does not use file names, and inode numbers are used to identify files. For the system, the file name is just an alias or nickname for the inode number to easily identify.

On the surface, the user opens the file by file name. In fact, this process inside the system is divided into three steps: First, the system finds the inode number corresponding to the file name, and secondly, obtains the inode information through the inode number, and finally, according to the Inode information, finds the block of the file data and reads the data.

With the Ls-i command, you can see the inode number corresponding to the file name:

　　

　　

0x05 Directory File

In a unix/linux system, directory is also a file. Opening the directory is essentially opening the directory file.

The structure of the catalog file is very simple, which is a list of a series of catalog items (dirent). Each directory entry consists of two parts: the file name of the included file, and the inode number that corresponds to the file name.

The ls-i command lists the entire directory file, the file name and inode number:

　　

If you want to view the details of a file, you must access the Inode node based on the inode number and read the information. The ls-l command lists the details of the file.

　　

Understanding the above knowledge, you can understand the permissions of the directory. The Read permission (r) and Write permission (W) for the directory file are for the directory file itself. Because only the file name and inode number are in the directory file, if you have Read permission, you can only get the file name and cannot get additional information because the other information is stored in the Inode node, and the information inside the Inode node requires execute permission (x) of the directory file.

0x06 Hard Links

In general, the file name and inode number are the "one by one correspondence" relationship, and each inode number corresponds to a file name. However, the Unix/linux system allows multiple filenames to point to the same inode number.

This means that the same content can be accessed with different file names, and changes to the contents of the file affect all file names, but deleting a file name does not affect access to another file name. This is referred to as a "hard link".

The ln command can create a hard link: the ln source file destination file

　　

After running the above command, the source file is the same as the inode number of the destination file, pointing to the same inode. One of the inode information is called the "number of links," which records the total number of filenames pointing to the inode, which increases by 1.

Conversely, deleting a file name causes the "number of links" in the Inode node to be reduced by 1. When this value is reduced to 0, indicating that no file name points to the Inode, the system reclaims the inode number and its corresponding block region.

Here, by the way, the "number of links" to the catalog file. When you create a catalog, two catalog entries are generated by default: "." and ".". The inode number of the former is the inode number of the current directory, which is equivalent to the "hard link" of the current directory, and the inode number is the inode number of the parent directory of the current directory, which is equivalent to the "hard link" of the parent directory. Therefore, the total number of "hard links" in any directory is always equal to 2 plus the total number of subdirectories (with hidden directories).

0x07 Soft Links

In addition to hard links, there is a special case.

The inode number for file A and file B is different, but the content of file A is the path to file B. When you read file A, the system automatically directs the visitor to file B. Therefore, regardless of which file you open, the final read is file B. At this point, file A is referred to as the "soft link" of File B (soft link) or "Symbolic link" (symbolic).

This means that file a depends on file B and if file B is deleted, opening file A will cause an error: "No such file or directory". This is the biggest difference between soft links and hard links: file a points to file B's file name, not file B's inode number, and file B's Inode "link count" does not change.

The ln-s command can create a soft link.

　　

　　

The special role of the 0x08 Inode

Because the inode number is separated from the file name, this mechanism causes some unix/linux system-specific phenomena.

1. Sometimes the file name contains special characters and cannot be deleted properly. At this point, delete the Inode node directly, you can play the role of deleting files.

2. Move or rename the file, just change the file name without affecting the inode number.

3. After opening a file, the system will identify the file with the Inode number and no longer consider the filename. Therefore, it is generally not possible for the system to know the file name from the inode number.

The 3rd makes software updates simple and can be updated without shutting down the software, without requiring a restart. Because the system through the Inode number, identify the running files, not through the file name. Update, the new version of the file with the same file name, the generation of an inode, will not affect the running files. The next time you run this software, the file name will automatically point to the new version of the file, the old file's inode is recycled.

　　

　　

Reference: http://www.ruanyifeng.com/blog/2011/12/inode.html

Understanding of the Inode under Linux