The Mac OS X Filesystem (Mac OS X for Unix Geeks)

A.1. Files and Directories

Table A-1 describes the files and directories you may find in your root directory. The remaining tables in this chapter describe significant subdirectories.

Table A-1. Mac OS X's root directory

File or directory	Description
.DS_Store	This file contains Finder settings, such as icon location and window size. The file will appear in any directory that you've viewed with the Finder.
.Trashes/	This directory contains files that have been dragged to the Trash. On a boot volume, such files are stored in ~/.Trash. On a non-boot volume, these files are in /.Trashes/`uid``/`.
.hidden	This file contains a list of files that should be invisible to the Finder.
.vol/	This directory maps HFS+ file IDs to files. If you know a file's ID, you can open it using /.vol/`id`.
Applications (Mac OS 9)/	This directory contains all your OS 9 applications, if you've got Mac OS X and Mac OS 9 installed.
Applications/	This directory holds all your Mac OS X applications. Its Utilities subdirectory includes lots of useful things, such as Terminal and Console.
Desktop DB	This file, along with Desktop DF, contains the desktop database that is rebuilt when you click Rebuild Desktop in System Preferences Classic.
Desktop DF	See Desktop DB.
Desktop Folder/	This directory is the Mac OS 9 desktop folder.
Developer/	This directory contains Apple's Developer Tools and documentation. This is only available if you have installed the Developer Tools.
Documents/	This is the Mac OS 9 documents folder.
Library/	This directory contains support files for locally installed applications, among other things. See Table A-4, later in this chapter.
Network/	This directory contains network-mounted Application, Library, and Users directories, as well as a Servers directory, which contains directories mounted by the automount daemon.
Shared Items/	In Mac OS 9, this folder gave multiuser systems a place where users could store files that other users could access.
System Folder/	This is the Mac OS 9 System Folder.
System/	This directory contains a subdirectory, Library, which holds support files for the system and system applications, among other things. See Table A-3, later in this chapter.
Temporary Items/	This directory contains temporary files used by Mac OS 9.
TheVolumeSettingsFolder/	This directory keeps track of details such as open windows and desktop printers.
Trash/	This directory is where Mac OS 9 stores deleted files until the Trash is emptied.
Users/	This directory contains home directories for the users on the system. The root user's home directory is /var/root.
VM Storage	This is the Mac OS 9 virtual memory file.
Volumes/	This directory contains all mounted filesystems, including removable media and mounted disk images.
automount/	This directory handles static NFS mounts for the automount daemon.
bin/	This directory contains essential system binaries.
cores/	This directory is a symbolic link (or symlink) to /private/cores. If core dumps are enabled (with tcsh's limit and bash/sh's ulimit commands--see the tcsh and bash manpages for more details), they will be created in this directory as core.`pid`.
dev/	This directory contains files that represent various devices. See Table A-6, later in this chapter.
etc/	This directory contains system configuration files. See Table A-2, later in this chapter. The directory is a symbolic link to /private/etc.
lost+found	This directory stores orphaned files discovered by fsck.
mach	This is a symbolic link to the /mach.sym file.
mach.sym	This file contains kernel symbols. It is generated during each boot by /etc/rc.
mach_kernel	This is the Darwin kernel. See Chapter 7 for more information about the kernel.
private/	This private directory contains the tmp, var, etc, and cores directories.
sbin/	This directory contains executables for system administration and configuration.
tmp/	This directory holds temporary files. It is a symbolic link to /private/tmp.
usr/	This directory contains BSD Unix applications and support files.
var/	This directory contains frequently modified files, such as log files. It is a symbolic link to /private/var.

A.1.1. The /etc Directory

The /etc directory contains configuration files for Unix applications and services, as well as scripts that control system startup. Table A-2 lists the contents of the /etc directory.

Table A-2. The /etc directory

File or directory	Description
6to4.conf	Configuration file for encapsulating IPv6 within IPv4. See ip6config(8).
X11/	X11 configuration directory. This will be present only if you have installed XDarwin.
acgid/	File that contains configuration files for acgid, a bridge between Apache and ACGI-capable scripting languages, such as AppleScript. Mac OS X Server only. For equivalent functionality under Mac OS X, see http://www.sentman.com/acgi/.
afpovertcp.cfg	File that causes Mac OS X to use TCP/IP as the default transport for Apple File Protocol (AFP). Use this file to configure the defaults for AFP over TCP/IP.
appletalk.cfg	AppleTalk configuration file for routing or multihoming. See the appletalk.cfg(5) manpage.
authorization	File that controls how applications, such as installers, can temporarily obtain root privileges.
bashrc	Global configuration file for bash, the Bourne-again shell.
crontab	root's crontab. See Section 2.3.1.
csh.cshrc	Global csh configuration file, processed when the shell starts up. If you have a .cshrc or .tcshrc file in your home directory, tcsh will execute its contents as well.
csh.login	Global csh login file, processed when a login shell starts up. If you have a .login file in your home directory, tcsh will execute its contents as well.
csh.logout	Global csh logout file, processed when a user logs out of a login shell.
cups/	Directory that contains configuration files for Common Unix Printing System (CUPS).
daily	cron job that is run once a day (see crontab). This is a symlink to /etc/periodic/daily/500.daily.
defaults/	Directory that contains default configuration files for applications and utilities.
diskspacemonitor/	Configuration files for diskspacemonitor, which monitors the amount of free disk space. Mac OS X Server only.
dumpdates	Dump date records created by dump(5), which is run by /etc/daily.
find.codes	Description not available at time of writing; see errata page at http://www.oreilly.com/catalog/mosxgeeks.
ftpusers	List of users who are prohibited from using FTP.
gdb.conf	Global gdb configuration file.
gettytab	Terminal configuration database.
group	Group permissions file. See Chapter 3 for more information.
hostconfig	System configuration file that controls many of the startup items described in Section 2.1.4 in Chapter 2.
hosts	Host database; a mapping of IP addresses to hostnames. You can use this as a supplement to other Directory Services, such as DNS. Mac OS X 10.1 and earlier consulted this file only in single-user mode, but Mac OS X 10.2 (Jaguar) uses this file at other times. For more information, see Chapter 3.
hosts.equiv	List of trusted remote hosts and host-user pairs. This is used by rsh and is inherently insecure. You should use ssh instead, which is a secure alternative. See ssh-keygen(1) to generate key pairs that can be used to set up a trust relationship with remote users.
hosts.lpd	List of hosts that are allowed to connect to the Unix lpd service.
httpd/	Directory that contains Apache's configuration files.
iftab	Configuration file for network interfaces.
inetd.conf	Internet super-server (inetd) configuration file.
IPAliases	Configuration file for IP aliases.
kcpassword	Description not available at time of writing; see errata page at http://www.oreilly.com/catalog/mosxgeeks.
kern_loader.conf	Description not available at time of writing; see errata page at http://www.oreilly.com/catalog/mosxgeeks.
localtime	Symbolic link to your system's time zone, such as: /usr/share/zoneinfo/US/Eastern.
magic	Database of magic numbers used by the file command to determine a file's type.
mail/	Directory that contains configuration files for sendmail. Note that Open Directory handles the mail aliases (see Chapter 3).
mail.rc	Global configuration file for /usr/bin/mail.
manpath.config	Configuration file for man.
master.passwd	Shadow passwd file. This is consulted only in single-user mode. During normal system operation, Open Directory manages user information (see Chapter 3).
moduli	System-wide prime numbers used for cryptographic applications such as ssh.
monthly	Monthly cron job (see crontab). This is a symlink to /etc/periodic/monthly/500.monthly.
motd	Message of the day. This is displayed each time you launch a new Terminal or log in remotely.
named.conf	Configuration file for named, the DNS daemon. For more details, see named(8).
networks	Network name database.
ntp.conf	Configuration file for the Network Time Protocol daemon, which synchronizes system time by accessing a remote server.
openldap/	Directory that contains configuration files for OpenLDAP, an implementation of the Lightweight Directory Access Protocol.
pam.d/	Directory that contains configuration files for PAM .
passwd	Password file. For more information, see Chapter 3.
periodic/	Directory that contains configuration files for the periodic utility, which runs cron jobs on a regular basis.
ppp/	Contains configuration files for Point-To-Point Tunneling Protocol (PPTP). Mac OS X Server only.
printcap	Printer configuration file for lpd. CUPS automatically generates this file. For more information, see cupsd(8).
profile	Global profile for the Bourne-again shell.
protocols	Network protocol database.
racoon/	Directory that contains configuration files for raccoon, the IKE key management daemon.
rc	Startup script for multiuser mode.
rc.boot	Startup script for single-user mode.
rc.cleanup	Cleanup script invoked by /etc/rc.
rc.common	Common settings for startup scripts.
rc.netboot	Startup script for booting from the network using NetBoot.
resolv.conf	DNS resolver configuration.
resolver/	Contains files used to resolve hostnames.
rmtab	Remote NFS mount table.
rpc	RPC number-to-name mappings. Mac OS X 10.1 and earlier consulted this file only in single-user mode, but Mac OS X 10.2 (Jaguar) uses this file at other times. For more information, see Chapter 3.
rtadvd.conf	Configuration file for the router advertisement daemon. For more details, see rtadvd(8).
servermgrd/	Configuration files for the Server Manager daemon. Mac OS X Server only.
services	Internet service name database. Mac OS X 10.1 and earlier consulted this file only in single-user mode, but Mac OS X 10.2 (Jaguar) uses this file at other times. For more information, see Chapter 3.
shells	List of shells.
slpsa.conf	Configuration file for the service locator daemon (slpd).
smb.conf	Samba configuration file.
smb.conf.template	Template configuration file for Samba.
squirrelmail/	Configuration files for SquirrelMail, a web-based email client. See http://www.squirrelmail.org. Mac OS X Server only.
ssh_config	Global configuration file for OpenSSH client programs.
ssh_host_dsa_key	Private DSA host key for OpenSSH. This file, and the other ssh_host_* files, are created the first time you start Remote Login in the Sharing System Preferences.
ssh_host_dsa_key.pub	Public DSA host key for OpenSSH.
ssh_host_key	Private host key for OpenSSH when using SSH 1 compatibility.
ssh_host_key.pub	Public host key for OpenSSH when using SSH 1 compatibility.
ssh_host_rsa_key	Private RSA host key for OpenSSH.
ssh_host_rsa_key.pub	Public RSA host key for OpenSSH.
sshd_config	Configuration file for the OpenSSH sshd daemon.
sudoers	Configuration file for the sudo command. Make sure you use the visudo command only to edit this file.
syslog.conf	syslogd configuration file.
ttys	Terminal initialization file.
ttys.installer	Description not available at time of writing; see errata page at http://www.oreilly.com/catalog/mosxgeeks.
watchdog.conf	Configuration file for Mac OS X Server's watchdog service. Watchdog restarts certain daemons if they die (similar to System V inittab).
webperfcache	File that contains configuration files for Mac OS X Server's webperfcache service, which sits between port 80 and your web server and caches static pages.
weekly	Weekly cron job (see crontab). This is a symlink to /etc/periodic/weekly/500.weekly.
xinetd.conf	Configuration file for xinetd, the extended Internet superserver daemon.
xinetd.d/	File that contains service-specific configuration files for xinetd.
xtab	Description not available at time of writing; see errata page at http://www.oreilly.com/catalog/mosxgeeks.

A.1.2. The /System/Library Directory

Table A-3 lists the directories stored under the /System/Library directory. You should not modify the contents of these directories or add new files to them. Instead, use their counterparts in the /Library folder. For example, to install a new font, drag it into /Library/Fonts, not /System/Library/Fonts.

Table A-3. The /System/Library directory

File or directory	Description
Axis/	Contains support files for Apache Axis. Mac OS X Server only.
Assistants/	Contains support files for the setup assistant. Mac OS X Server only.
Caches/	Contains caches used by various parts of the operating system.
CFMSupport/	Holds shared libraries used by Carbon applications.
Classic/	Description not available at time of writing; see errata page at http://www.oreilly.com/catalog/mosxgeeks.
ColorPickers/	Includes localized resources for Mac OS X color pickers.
Colors/	Lists the names and values of colors used in the color picker control.
ColorSync/	Contains ColorSync profiles.
Components/	Contains application building blocks (components), such as AppleScript and color pickers. Components are not applications themselves and are generally shared between applications.
CoreServices/	Contains system applications, such as SystemStarter, BootX, the Finder, and the login window.
Displays/	Contains ColorSync information for external monitors.
DTDs/	Contains document type definitions for XML documents used by the system, such as property lists.
Extensions/	Holds Darwin kernel extensions.
Extensions.kextcache	Contains information about extensions in the cache; a compressed XML document.
Extensions.mkext	Contains the kernel extension cache. It is created at boot by /etc/rc.
Filesystems/	Contains drivers and utilities for various filesystems (MS-DOS, AppleShare, UFS, etc.).
Find/	Includes support files for Sherlock's content indexing.
Fonts/	Contains core Mac OS X fonts.
Frameworks/	Holds a collection of reusable application frameworks, including shared libraries, headers, and documentation.
Image Capture/	Contains device support files for the Image Capture application.
Java/	Contains Java class and jar files.
Keyboard Layouts/	Contains bundles that support internationalized keyboard layouts.
Keyboards/	Contains keyboard mappings.
Keychains/	Contains system-wide keychain files. (~/Library/Keychains contains per-user keychains.)
LoginPlugins/	Contains helper applications that are launched as you log in.
Modem Scripts/	Contains modem configuration scripts.
MonitorPanels/	Includes panels used by System Preferences Displays.
OpenSSL/	Holds OpenSSL configuration and support files.
Perl/	Holds Perl Libraries.
PHP/	Contains PHP Libraries.
PreferencePanes/	Contains all the preference panes for the Preferences application.
Printers/	Contains printer support files.
PrivateFrameworks/	Holds private frameworks meant to support Mac OS X. These frameworks are not meant for programmers' use.
QuickTime/	Holds QuickTime support files.
QuickTimeJava/	Includes support files for the QuickTime/Java bridge.
Rulebooks/	Contains information used for text handling, such as word-breaking rules for hyphenation.
Screen Savers/	Contains screensavers that you can select from System Preferences Screen Saver.
ScriptingAdditions/	Includes AppleScript plug-ins and libraries.
Server Settings/	Contains plug-ins for the Server Settings utility. Mac OS X Server only.
ServerSetup/	Contains support files used when setting the initial server configuration. Mac OS X Server only.
Services/	Contains services that are made available through the Services menu.
Sounds/	Contains sounds that are available in System Preferences Sound.
Speech/	Includes speech recognition and generation support files.
StartupItems/	Contains startup scripts as described in Chapter 2.
SystemConfiguration/	Contains plug-ins used to monitor various system activities (for Apple use only).
SystemResources/	Contains precompiled header lists for the C compiler (see Section 5.1.1).
Tcl/	Holds Tcl libraries.
TextEncodings/	Contains localized text encodings.
User Template/	Lists localized skeleton files for user directories. See Section 3.8.3.

A.1.3. The /Library Directory

Table A-4 lists the contents of the /Library directory. This directory contains counterparts to many directories found in /System/Library. You can use the /Library counterparts for system-wide customization. If you find a directory of the same name in your home Library directory (~/Library), you can use that for user-level customization. For example, you can install fonts for one particular user by moving them into ~/username/Library/Fonts.

Table A-4. The /Library directory

File or directory	Description
Application Support/	Contains support files for locally installed applications.
Audio/	Contains audio plug-ins and sounds.
Authenticators/	Contains authentication code for locally installed applications.
Caches/	Contains cached data used by various parts of the operating system.
CFMSupport/	Holds shared libraries used by Carbon applications.
ColorSync/	Contains user-installed ColorSync profiles and scripts.
Desktop Pictures/	Contains desktop pictures used by System Preferences Desktop.
Documentation/	Provides documentation for locally installed applications.
FTPServer/	Contains configuration files and the root folder of anonymous FTP server. Mac OS X Server only.
Filesystems/	Contains authentication support for the Apple Share network client.
Fonts/	Contains locally installed fonts.
Image Capture/	Contains locally installed scripts and plug-ins for the Image Capture application.
Internet Plug-Ins/	Contains locally installed browser plug-ins.
Java/	Contains locally installed Java classes (you can drop jar files into /Library/Java/Extensions), as well as a suitable directory to use as your `$JAVA_HOME` (/Library/Java/Home).
Keyboard Layouts/	Contains keyboard mappings.
Logs/	Holds logs for services such as Apple File Services, the Crash Reporter, and the Directory Service.
Macintosh Manager/	Contains support files for the Macintosh Manager application (Mac OS X Server only).
Modem Scripts/	Holds support files for various modem types.
Perl/	Lists locally installed Perl modules (MakeMaker's `INSTALLSITELIB`).
PreferencePanes/	Contains system preference panes for locally installed utilities such as TinkerTool.
Preferences/	Lists global preferences.
Printers/	Lists printer drivers and utilities.
QuickTime/	Contains locally installed QuickTime components.
QuickTimeStreaming/	Contains the QuickTime Streaming Server (Mac OS X Server only).
Receipts/	Leaves a receipt in the form of a .pkg directory after you install an application with the Mac OS X installer. The .pkg directory contains a bill of materials file (.bom), which you can read with the lsbom command.
Screen Savers/	Lists locally installed screensavers.
Scripts/	Contains a variety of AppleScripts installed with Mac OS X.
StartupItems/	Lists locally installed startup items. See Section 2.2.
Tomcat/	Holds the Apache Tomcat Java Servlet and JSP server (Mac OS X Server only).
User Pictures/	Contains user pictures that are used in the login panel.
WebServer/	Contains the Apache CGI and document root directories.

A.1.4. The /var Directory

The /var directory contains transient and volatile files, such as PID files (which tell you the process ID of a currently running daemon), log files, and many others. Table A-5 lists the contents of the /var directory.

Table A-5. The /var directory

File or directory	Description
at/	Contains information about jobs scheduled with the at command.
backups/	Contains backups of the NetInfo database.
cron/	Contains user crontab files.
db/	Includes a grab bag of configuration and data files, including the locate database, the NetInfo database, and network interface information.
empty/	Description not available at time of writing; see errata page at http://www.oreilly.com/catalog/mosxgeeks.
log/	Contains a variety of log files, including syslog, mail, and web server logs.
mail/	Contains inboxes for local users' email.
msgs/	Holds system-wide messages that were delivered using msgs -s.
named/	Includes various files used for local DNS services.
netboot/	Contains various files used for NetBoot.
root/	Serves as the root user's home directory.
run/	Holds PID files for running processes. Also contains working files used by programs such as sudo.
rwho/	Contains information used by the rwho command.
servermgrd/	Contains runtime files used by the Server Manager daemon. Mac OS X Server only.
spool/	Serves as a spool directory for mail, printer queues, and other queued resources.
tmp/	Serves as a temporary file directory.
vm/	Contains your swap files.
yp/	Contains files used by NIS.

A.1.5. The /dev Directory

The /dev directory contains files that represent devices attached to the system, including physical devices, such as serial ports, and pseudodevices, such as a random number generator. Table A-6 lists the contents of the /dev directory.

Table A-6. The /dev directory

File or directory	Description
bpf[0-3]	Berkeley Packet Filter devices. See bpf(4).
console	The system console. This is owned by whoever is currently logged in. If you write to it, the output will end up in /var/tmp/console.log, which you can view with the Console application (/Applications/Utilities).
cu.modem	Modem device for compatibility with the Unix cu (call up) utility.
disk[0-n]	Disk.
disk[0-n]s[0-n]	Disk partition. For example, /dev/disk0s1 is the first partition of /dev/disk0.
fd/	Devices that correspond to file descriptors. See the fd manpage for more details.
klog	Device used by syslogd to read kernel messages.
kmem	Image of kernel memory.
mem	Image of the system memory.
null	Bit bucket. You can redirect anything here, and it will disappear.
ptyp[0-f]	Master ends of the first sixteen pseudo-ttys.
pty[q-w][0-f]	Master ends of the remaining pseudo-ttys.
random	Source of pseudorandom data. See random(4).
rdisk[0-n]	Raw disk device.
rdisk[0-n]s[0-n]	Raw disk partition.
stderr	Symbolic link to /dev/fd/2.
stdin	Symbolic link to /dev/fd/0.
stdout	Symbolic link to /dev/fd/1.
tty	Standard output stream of the current Terminal or remote login.
tty.modem	Modem device.
ttyp[0-f]	Slave ends of the first sixteen pseudo-ttys.
tty[q-w][0-f]	Slave ends of the remaining pseudo-ttys.
urandom	Source of pseudorandom data, not guaranteed to be strong. See random(4).
vn[0-3]	Pseudo disk devices.
zero	Infinite supply of null characters. Often used with dd to create a file made up of null characters.