Open File by Inode

What is the difference between an open file and inode?

ext2+, NTFS, and other filesystems have a master table of files on the drive, and directories are just a special kind of file full of records that point to entries in the file table. (This setup allows for hard links, as well as "temporary files" that aren't visible via the directory structure.) An "inode" is Linux's (and probably other *nixes') term for those master file table entries.

An inode doesn't track the current position within the file or the current mode (open for reading, writing, both...?), though. It only contains info that helps the OS find the contents of the file on disk and keep people who shouldn't be messing with it from doing so. You need a different structure to track that info. That'd likely be the "open file" structure you're seeing.

Apparently, the "file" structure also has a structure inside of it full of pointers to functions for stuff you can do with the file. This would be in order to support Unix's "everything is a file" philosophy and let you read and write to, say, a socket the same way you would to a regular file, as well as to provide a way to abstract away the filesystem-specific code from the code that'd work for everything (which makes supporting multiple filesystem types a lot easier).

Is there a way to open file by known inode

Short of a brute-force search of the filesystem for the inode (ex, find / -inum $X), you can't.

See the discussion here: http://coding.derkeiler.com/Archive/Perl/comp.lang.perl.misc/2006-05/msg02223.html

How to get file contents by inode in Bash?

As per this unixexchange answer:

You cannot access files by inodes, because that would break access control via permissions. For example, if you don't have the permission to traverse a directory, then you can't access any of the files in that directory no matter what the permissions on the file are. If you could access a file by inode, that would bypass directory permissions.

There is some ways to get the path or name of a file through an inode number though, for example using find. Once you get one path to the file, you can use any of the regular tools.

find has an inum argument to look up files by inodes. Here is an example:

find -inum 1704744 -exec cat {} \;

This will print the content of the file with inode 1704744, assuming it is located in the current directory or one of its children.

Note: ls also has a -i option to get the inode associated with files.

How to open and read file from `struct inode *` in Linux kernel

I finally did it like this:

1. This is needed.

struct path root;
struct file *filerd;

2. Get the init task fs root.

task_lock(&init_task);
get_fs_root(init_task.fs, &root);
task_unlock(&init_task);

3. Change dentry to this file:

root.dentry = d_find_alias(inode);

4. Open file:

filerd = file_open_root(root.dentry->d_parent, root.mnt,
                        root.dentry->d_name.name, O_RDONLY);

It worked for every process I tested and for different mount points, which surprised me.

Why can't files be manipulated by inode?

Some Operating Systems do have that facility. For example, OS X needs it to support the Carbon File Manager, and on Linux you can use debugfs. Of course, you can do it on any UNIX from the command-line via find -inum, but the real reason you can't access files by inode is that it isn't particularly useful. It does kindof circumvent file permissions, because if there's a file you can read in a folder you can't read or execute, then opening the inode lets you discover it.

The reason it isn't very useful is that you need to find an inode number via a *stat() call, at which point you already have the filename (or an open fd)...or you need to guess the inum.

---

Related Topics