BSD syscall#10
svc · unix #10
unlink
Removes a directory entry, releasing the associated inode when its link count reaches zero.
Prototype
int unlink(user_addr_t path);Returns: int
Arguments
| Name | Type | Dir | Description |
|---|---|---|---|
| path | user_addr_t | - |
Version history
| XNU tag | macOS | # |
|---|---|---|
| xnu-1456.1.26 | macOS 10.6 Snow Leopard | 10 |
| xnu-1486.2.11 | — | 10 |
| xnu-1504.15.3 | — | 10 |
| xnu-1504.3.12 | — | 10 |
| xnu-1504.7.4 | — | 10 |
| xnu-1504.9.17 | — | 10 |
| xnu-1504.9.26 | — | 10 |
| xnu-1504.9.37 | — | 10 |
Notes
If processes still hold the file open the storage is reclaimed only after the last close. On macOS unlink on a file with the schg or uchg flag returns EPERM unless the flag is first cleared via chflags. SIP protects certain paths even from root.
Detection
ES emits ES_EVENT_TYPE_NOTIFY_UNLINK with the parent and removed vnode.
Related APIs
unlinkatrmdirrenameopenchflags