When the last directory entry for a file is passed to the unlink() system call, the file is removed from the directory hierarchy.
However, the data on media will be deleted only after all open file descriptors are closed.
One exploitation of this feature that I have seen is the SQLite temporary tablespace, which is created and immediately unlinked, ensuring that it will not persist after the program terminates.
When the last directory entry for a file is passed to the unlink() system call, the file is removed from the directory hierarchy.
However, the data on media will be deleted only after all open file descriptors are closed.
One exploitation of this feature that I have seen is the SQLite temporary tablespace, which is created and immediately unlinked, ensuring that it will not persist after the program terminates.