ununlink is link() on a /proc/<pid>/fd/<fd> entry. Assuming some process still has the file open, that is.

Does that mean that one could implement "undelete" by changing open() so that some central process (let's call it "recycle-bin") also opens a copy at the same time a process opens them (but keeps it open until you send it a "empty" signal), and then calling that link()?

You could use LD_PRELOAD to replace unlink with a version that passes an fd to a running recycle-bin daemon. That approach doesn't really have much, or any, advantage over just moving files to a recycle-bin folder and keeping track of items in there.

It would "automatically empty" the recycle bin at each shutdown though.

Doesn't it have the advantage that "rm" and co are then made automatically undo-able?

(Whereas moving to recycle-bin is a manual process you need to remember to do).

Also a manual process -- and per user at that...

link() doesn't work for this use case.

You need linkat() with the AT_SYMLINK_FOLLOW flag enabled.