52

On my Linux filesystem, a symlink points to 127.0.1.1:+xxxxx.

Why the plus sign? Could there also be a minus? Why not just 127.0.1.1:xxxxx?

Scott - Слава Україні
  • 21,399
  • 46
  • 64
  • 121
myMethod
  • 621
  • 5
  • 5

2 Answers2

93

Symbolic links which don't point to a file have no generic meaning at all. In this case it might be the process ID, or a port with some special protocol spoken over it, or another identifier. It all depends on what program made it.

Software which creates these links simply takes advantage of the facts that 1) a symlink's target may be non-existent or even total nonsense; 2) creating a symlink is a single-syscall completely atomic operation (as is reading its target), unlike creating a regular file which takes at least 3 separate system calls.

Thus symlink creation can be abused as a way of locking (ensuring single instance of a program) even when other mechanisms may be unreliable. The program doesn't need the symlink to actually resolve to a real file: it only cares about whether creating the link succeeds, or whether it fails due to it already existing.

u1686_grawity
  • 426,297
  • 64
  • 894
  • 966
  • 5
    "* unlike creating a regular file which takes at least 3 separate system calls.*" -- Could you clarify? Do you mean `fopen`, `fwrite`, and `fclose`? – Nic Oct 04 '18 at 19:21
  • 11
    @NicHartley: The system calls are `open` (or maybe `creat` in old software), `write`, and `close`, not the f* versions that stdio provides. But, yes, you need to do at least `open` and `write` to create the file and put something meaningful into it. Now if you want some code to "try to create it, if successful, put some information into it, else, read some information from it", the second process could just try its `read` before the first process has a chance to `write`. `symlink` avoids that; either succeed and create the link, or fail and be sure `readlink` has the information for you. – Guntram Blohm Oct 04 '18 at 19:50
  • "...can be **abused** as a way..." Is this abuse as in "used in a way it was _not intended_ to be used" or "used in a way it _should not_ be used"? – The Guy with The Hat Oct 26 '18 at 19:23
22

As far as I know the "+" means that the number after the IP (the "xxxxx") refers to a "process ID" (not a port which usually uses the notation [IP-address]:[portnumber]).

It is possible that this "notation" (not sure I would call it a "notation" since I don't know of any "official" documentation) refers to something else if used by a specific application - but then again, that's always the possibility not only with symlinks. The only cases I know of (and could find with a search that wasn't too extensive) the "+XXXX" always refered to the process ID.

Albin
  • 9,307
  • 11
  • 50
  • 89
  • 1
    I just checked it. In my case it really does. – myMethod Oct 03 '18 at 19:27
  • 1
    Is there documentation of this format somewhere that you could link to? – David Z Oct 03 '18 at 20:31
  • 1
    Not sure, I just remember it from hands on experience. – Albin Oct 03 '18 at 20:55
  • 2
    It sounds like you're talking about a symlink in a special directory, like `/proc` or `/dev`. Can you explain what this symlink is used for? – Barmar Oct 04 '18 at 01:48
  • @Barmar I'm refering to the notation in general, I'm not talking about a specific symlink in a specific directory – Albin Oct 04 '18 at 09:53
  • 4
    This is the first time I've seen this notation at all, so I'm surprised to hear you say that it's a general notation. Where have you seen it used to mean a process ID? – Barmar Oct 04 '18 at 15:24
  • @Barmar I have no idea how "general" this notation really is, if it's a distribution specific thing or whatever. When I looked it it up quite a while ago the only resources I found referenced the number after the + to a process ID which was the solution in my case as well. myMethod said in his first comment that it applies in his use case too. – Albin Oct 04 '18 at 19:40
  • I've never seen this notation anywhere before, it sounds like it may be specific to a particular application. Do you remember where yiou saw it before? – Barmar Oct 04 '18 at 19:42
  • @Barmar no, I just remember it took me a while to find the answer. Just look the "IP:+" notation after some trial and error you should find a few examples (most results will point you to the IP:PORT notation, but that wasn't it, that's why I still remember - and because it was a linux based issue which I don't deal with very often) – Albin Oct 04 '18 at 19:47