-1

Is it possible to use stat for retrieving meta data of File1 by passing File1's inode number as an argument to stat instead of the file name?

stat [option - any doing this?] [inode number of File1]

instead of

stat /home/$USER/File1

I mean that directly, not with any piping and command substitution trickery.

2
  • 1
    I don't think it will be, for the same reason that opening a file directly via an inode isn't possible - this will bypass access controls on possible ancestor directories and leak metadata. Commented Jan 19, 2024 at 9:44
  • 1
    Hmm, it seems you asked specifically about the stat command and then accepted an answer using the debugfs command (which is specific to ext4 filesystems). What's the actual question here? Commented Jan 20, 2024 at 14:36

2 Answers 2

2

Like this one?

sudo debugfs -R "stat <237770>" /dev/sda1

For me, it gives me this output:

Inode: 237770   Type: regular    Mode:  0644   Flags: 0x80000
Generation: 3934018986    Version: 0x00000000:00000001
User:  1000   Group:  1000   Project:     0   Size: 3878
File ACL: 0
Links: 1   Blockcount: 8
Fragment:  Address: 0    Number: 0    Size: 0
 ctime: 0x65844b48:c3cc9104 -- Thu Dec 21 15:27:20 2023
 atime: 0x65844b4f:d21ab1e8 -- Thu Dec 21 15:27:27 2023
 mtime: 0x65844b48:c3cc9104 -- Thu Dec 21 15:27:20 2023
crtime: 0x6584497f:07719290 -- Thu Dec 21 15:19:43 2023
Size of extra inode fields: 32
Inode checksum: 0x6a9c083c
EXTENTS:
(0):2478609
2

No, by design it's not possible to access a file other than via a path to it, allowing it would bypass access control so that would be a security flaw.

root can possibly do that by using tools such as debugfs (for ext4 file systems) on the block device containing the filesystem (if any) effectively bypassing the kernel to inspect the filesystem structure but doing that on a mounted filesystem is not necessarily reliable; or using kernel instrumentation such as systemtap or bpftrace, though that's likely to be non-portable even between two versions of a given kernel.

So you should use something like:

find /root/of/filesystem -xdev -inode 12345 -exec stat {} ';'

To find the path(s) leading to that file with that particular inode and call stat on them.

With GNU find, you can also use -printf to report stat(2) information about the file.

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.