Recovering an unlink-ed, but still opened file

[Mikhail T.]

On 27.11.2015 21:46, alex.burlyga.ietf alex.burlyga.ietf wrote:
>
> If you know which process and which file descriptor, should be able to
> just copy from /proc/<pid>/fd/<fd> to a file. I would try that first.
>
I know this trick -- and even used it on Solaris once. It may work on
Linux too. But not on FreeBSD:

    tail -f /var/log/messages > /var/tmp/l &
    [1] 13954
    mi at narawntapu:/usr/src (829) rm /var/tmp/l
    mi at narawntapu:/usr/src (830) ls -l /proc/13954/fd
    ls: /proc/13954/fd: No such file or directory

Worse, our linprocfs does not support that either:

    mi at narawntapu:/usr/src (831) ls -l /compat/linux/proc/13954/fd
    lr--r--r--  1 mi  wheel  0 27 лис 22:00 /compat/linux/proc/13954/fd
    -> *unknown*

Perhaps more importantly, even if the trick worked, it wouldn't have
been, what I asked for -- it would've allowed me to create a copy of the
file. I'd like to be able to restore access to the original -- so that,
for example, whatever the process writes to it is still available, etc.
Can that be done somehow? Thanks! Yours,

    -mi