Consider this scenario:
User is executing a command on a file. This file becomes 'in-use' now.
$ tail -f somefile.log
In another shell, user deletes the file.
$ rm somefile.log
Now, this file is 'removed'. Meaning the only hardlink to the file inode is gone. If you execute the following command, you can still see the file, indicated as 'deleted'.
$ lsof | grep somefile.log
Disk space used by
somefile.log is not released until user interrupts
tail command in this case.
My question is, is it possible to prevent users from deleting files that are in-use at the moment of deletion attempt (similar to Windows)? Is it possible to use PAM for this?