Re: Unreferenced files not being deleted

Peter Jeremy wrote:

>On Fri, 2006-Jan-27 06:56:47 +1100, Peter Jeremy wrote:
>  
>
>>On my recent -current, I've noticed that /var is filling up with
>>unreferenced files.
>>    
>>
>
>Updated data point:  The files do disappear on a clean shutdown
>so the kernel seems to be aware that they have no name but
>neither fstat nor lsof can find any processes holding them open.
>I have a core dump demonstrating the problem and will poke around
>in it as a background task.
>
>  
>
You know it occured to me that a process that is not in the process list 
would still work..

could be an easy way to effect a rootkit if one had root access.
wouldn't show up in ps, fstat etc.

it could be another answer to your mystery.. :-/