# Appendix A. The Mac OS X Filesystem

#### Contents:

Files and Directories

If you do an ls -a / on your Mac OS X box, you will see some familiar things, such as /etc and /var, but you will also notice some unfamiliar things, such as /TheVolumeSettingsFolder, /Library, and /Documents. The Mac OS X filesystem contains traces of Unix, NeXTSTEP, and the Mac OS 9. This chapter describes the contents of important directories. The tables in this chapter list directory entries (directories are denoted with a trailing slash) and provide a description of each file or directory.

## A.1. Files and Directories

Table A-1 describes the files and directories you may find in your root directory. The remaining tables in this chapter describe significant subdirectories.

#### Table A-1. Mac OS X's root directory

File or directory | Description
--- | ---
.DS_Store | This file contains Finder settings, such as icon location and window size. The file will appear in any directory that you've viewed with the Finder.
.Trashes/ | This directory contains files that have been dragged to the Trash. On a boot volume, such files are stored in ~/.Trash. On a non-boot volume, these files are in /.Trashes/`uid`/.
.hidden | This file contains a list of files that should be invisible to the Finder.
.vol/ | This directory maps HFS+ file IDs to files. If you know a file's ID, you can open it using /.vol/`id`.
Applications (Mac OS 9)/ | This directory contains all your OS 9 applications, if you've got Mac OS X and Mac OS 9 installed.
Applications/ | This directory holds all your Mac OS X applications. Its Utilities subdirectory includes lots of useful things, such as Terminal and Console.
Desktop DB | This file, along with Desktop DF, contains the desktop database that is rebuilt when you click Rebuild Desktop in System Preferences Classic.
Desktop DF | See Desktop DB.
Desktop Folder/ | This directory is the Mac OS 9 desktop folder.
Developer/ | This directory contains Apple's Developer Tools and documentation. This is only available if you have installed the Developer Tools.
Documents/ | This is the Mac OS 9 documents folder.
Library/ | This directory contains support files for locally installed applications, among other things. See Table A-4, later in this chapter.
Network/ | This directory contains network-mounted Application, Library, and Users directories, as well as a Servers directory, which contains directories mounted by the automount daemon.
Shared Items/ | In Mac OS 9, this folder gave multiuser systems a place where users could store files that other users could access.
System Folder/ | This is the Mac OS 9 System Folder.
System/ | This directory contains a subdirectory, Library, which holds support files for the system and system applications, among other things. See Table A-3, later in this chapter.
Temporary Items/ | This directory contains temporary files used by Mac OS 9.
TheVolumeSettingsFolder/ | This directory keeps track of details such as open windows and desktop printers.
Trash/ | This directory is where Mac OS 9 stores deleted files until the Trash is emptied.
Users/ | This directory contains home directories for the users on the system. The root user's home directory is /var/root.
VM Storage | This is the Mac OS 9 virtual memory file.
Volumes/ | This directory contains all mounted filesystems, including removable media and mounted disk images.
automount/ | This directory handles static NFS mounts for the automount daemon.
bin/ | This directory contains essential system binaries.
cores/ | This directory is a symbolic link (or symlink) to /private/cores. If core dumps are enabled (with tcsh's limit and bash/sh's ulimit commands--see the tcsh and bash manpages for more details), they will be created in this directory as core.`pid`.
dev/ | This directory contains files that represent various devices. See Table A-6, later in this chapter.
etc/ | This directory contains system configuration files. See Table A-2, later in this chapter. The directory is a symbolic link to /private/etc.
lost+found | This directory stores orphaned files discovered by fsck.
mach | This is a symbolic link to the /mach.sym file.
mach.sym | This file contains kernel symbols. It is generated during each boot by /etc/rc.
mach_kernel | This is the Darwin kernel. See Chapter 7 for more information about the kernel.
private/ | This private directory contains the tmp, var, etc, and cores directories.
sbin/ | This directory contains executables for system administration and configuration.
tmp/ | This directory holds temporary files. It is a symbolic link to /private/tmp.
usr/ | This directory contains BSD Unix applications and support files.
var/ | This directory contains frequently modified files, such as log files. It is a symbolic link to /private/var.

### A.1.1. The /etc Directory

The /etc directory contains configuration files for Unix applications and services, as well as scripts that control system startup. Table A-2 lists the contents of the /etc directory.

#### Table A-2. The /etc directory

File or directory | Description
--- | ---
6to4.conf | Configuration file for encapsulating IPv6 within IPv4. See ip6config(8).
X11/ | X11 configuration directory. This will be present only if you have installed XDarwin.
acgid/ | File that contains configuration files for acgid, a bridge between Apache and ACGI-capable scripting languages, such as AppleScript. Mac OS X Server only. For equivalent functionality under Mac OS X, see http://www.sentman.com/acgi/.
afpovertcp.cfg | File that causes Mac OS X to use TCP/IP as the default transport for Apple File Protocol (AFP). Use this file to configure the defaults for AFP over TCP/IP.
appletalk.cfg | AppleTalk configuration file for routing or multihoming. See the appletalk.cfg(5) manpage.
authorization | File that controls how applications, such as installers, can temporarily obtain root privileges.
bashrc | Global configuration file for bash, the Bourne-again shell.
crontab | root's crontab. See Section 2.3.1.
csh.cshrc | Global csh configuration file, processed when the shell starts up. If you have a .cshrc or .tcshrc file in your home directory, tcsh will execute its contents as well.
csh.login | Global csh login file, processed when a login shell starts up. If you have a .login file in your home directory, tcsh will execute its contents as well.
csh.logout | Global csh logout file, processed when a user logs out of a login shell.
cups/ | Directory that contains configuration files for Common Unix Printing System (CUPS).
daily | cron job that is run once a day (see crontab). This is a symlink to /etc/periodic/daily/500.daily.
defaults/ | Directory that contains default configuration files for applications and utilities.
diskspacemonitor/ | Configuration files for diskspacemonitor, which monitors the amount of free disk space. Mac OS X Server only.
dumpdates | Dump date records created by dump(5), which is run by /etc/daily.
find.codes | Description not available at time of writing; see errata page at http://www.oreilly.com/catalog/mosxgeeks.
ftpusers | List of users who are prohibited from using FTP.
gdb.conf | Global gdb configuration file.
gettytab | Terminal configuration database.
group | Group permissions file. See Chapter 3 for more information.
hostconfig | System configuration file that controls many of the startup items described in Section 2.1.4 in Chapter 2.
hosts | Host database; a mapping of IP addresses to hostnames. You can use this as a supplement to other Directory Services, such as DNS. Mac OS X 10.1 and earlier consulted this file only in single-user mode, but Mac OS X 10.2 (Jaguar) uses this file at other times. For more information, see Chapter 3.
hosts.equiv | List of trusted remote hosts and host-user pairs. This is used by rsh and is inherently insecure. You should use ssh instead, which is a secure alternative. See ssh-keygen(1) to generate key pairs that can be used to set up a trust relationship with remote users.
hosts.lpd | List of hosts that are allowed to connect to the Unix lpd service.
httpd/ | Directory that contains Apache's configuration files.
iftab | Configuration file for network interfaces.
inetd.conf | Internet super-server (inetd) configuration file.
IPAliases | Configuration file for IP aliases.
kcpassword | Description not available at time of writing; see errata page at http://www.oreilly.com/catalog/mosxgeeks.
kern_loader.conf | Description not available at time of writing; see errata page at http://www.oreilly.com/catalog/mosxgeeks.
localtime | Symbolic link to your system's time zone, such as: /usr/share/zoneinfo/US/Eastern.
magic | Database of magic numbers used by the file command to determine a file's type.
mail/ | Directory that contains configuration files for sendmail. Note that Open Directory handles the mail aliases (see Chapter 3).
mail.rc | Global configuration file for /usr/bin/mail.
manpath.config | Configuration file for man.
master.passwd | Shadow passwd file. This is consulted only in single-user mode. During normal system operation, Open Directory manages user information (see Chapter 3).
moduli | System-wide prime numbers used for cryptographic applications such as ssh.
monthly | Monthly cron job (see crontab). This is a symlink to /etc/periodic/monthly/500.monthly.
motd | Message of the day. This is displayed each time you launch a new Terminal or log in remotely.
named.conf | Configuration file for named, the DNS daemon. For more details, see named(8).
networks | Network name database.
ntp.conf | Configuration file for the Network Time Protocol daemon, which synchronizes system time by accessing a remote server.
openldap/ | Directory that contains configuration files for OpenLDAP, an implementation of the Lightweight Directory Access Protocol.
pam.d/ | Directory that contains configuration files for PAM .
passwd | Password file. For more information, see Chapter 3.
periodic/ | Directory that contains configuration files for the periodic utility, which runs cron jobs on a regular basis.
ppp/ | Contains configuration files for Point-To-Point Tunneling Protocol (PPTP). Mac OS X Server only.
printcap | Printer configuration file for lpd. CUPS automatically generates this file. For more information, see cupsd(8).
profile | Global profile for the Bourne-again shell.
protocols | Network protocol database.
racoon/ | Directory that contains configuration files for raccoon, the IKE key management daemon.
rc | Startup script for multiuser mode.
rc.boot | Startup script for single-user mode.
rc.cleanup | Cleanup script invoked by /etc/rc.
rc.common | Common settings for startup scripts.
rc.netboot | Startup script for booting from the network using NetBoot.
resolv.conf | DNS resolver configuration.
resolver/ | Contains files used to resolve hostnames.
rmtab | Remote NFS mount table.
rpc | RPC number-to-name mappings. Mac OS X 10.1 and earlier consulted this file only in single-user mode, but Mac OS X 10.2 (Jaguar) uses this file at other times. For more information, see Chapter 3.
rtadvd.conf | Configuration file for the router advertisement daemon. For more details, see rtadvd(8).
servermgrd/ | Configuration files for the Server Manager daemon. Mac OS X Server only.
services | Internet service name database. Mac OS X 10.1 and earlier consulted this file only in single-user mode, but Mac OS X 10.2 (Jaguar) uses this file at other times. For more information, see Chapter 3.
shells | List of shells.
slpsa.conf | Configuration file for the service locator daemon (slpd).
smb.conf | Samba configuration file.
smb.conf.template | Template configuration file for Samba.
squirrelmail/ | Configuration files for SquirrelMail, a web-based email client. See http://www.squirrelmail.org. Mac OS X Server only.
ssh_config | Global configuration file for OpenSSH client programs.
ssh_host_dsa_key | Private DSA host key for OpenSSH. This file, and the other ssh_host_* files, are created the first time you start Remote Login in the Sharing System Preferences.
ssh_host_dsa_key.pub | Public DSA host key for OpenSSH.
ssh_host_key | Private host key for OpenSSH when using SSH 1 compatibility.
ssh_host_key.pub | Public host key for OpenSSH when using SSH 1 compatibility.
ssh_host_rsa_key | Private RSA host key for OpenSSH.
ssh_host_rsa_key.pub | Public RSA host key for OpenSSH.
sshd_config | Configuration file for the OpenSSH sshd daemon.
sudoers | Configuration file for the sudo command. Make sure you use the visudo command only to edit this file.
syslog.conf | syslogd configuration file.
ttys | Terminal initialization file.
ttys.installer | Description not available at time of writing; see errata page at http://www.oreilly.com/catalog/mosxgeeks.
watchdog.conf | Configuration file for Mac OS X Server's watchdog service. Watchdog restarts certain daemons if they die (similar to System V inittab).
webperfcache | File that contains configuration files for Mac OS X Server's webperfcache service, which sits between port 80 and your web server and caches static pages.
weekly | Weekly cron job (see crontab). This is a symlink to /etc/periodic/weekly/500.weekly.
xinetd.conf | Configuration file for xinetd, the extended Internet superserver daemon.
xinetd.d/ | File that contains service-specific configuration files for xinetd.
xtab | Description not available at time of writing; see errata page at http://www.oreilly.com/catalog/mosxgeeks.

### A.1.2. The /System/Library Directory

Table A-3 lists the directories stored under the /System/Library directory. You should not modify the contents of these directories or add new files to them. Instead, use their counterparts in the /Library folder. For example, to install a new font, drag it into /Library/Fonts, not /System/Library/Fonts.

#### Table A-3. The /System/Library directory

File or directory | Description
--- | ---
Axis/ | Contains support files for Apache Axis. Mac OS X Server only.
Assistants/ | Contains support files for the setup assistant. Mac OS X Server only.
Caches/ | Contains caches used by various parts of the operating system.
CFMSupport/ | Holds shared libraries used by Carbon applications.
Classic/ | Description not available at time of writing; see errata page at http://www.oreilly.com/catalog/mosxgeeks.
ColorPickers/ | Includes localized resources for Mac OS X color pickers.
Colors/ | Lists the names and values of colors used in the color picker control.
ColorSync/ | Contains ColorSync profiles.
Components/ | Contains application building blocks (components), such as AppleScript and color pickers. Components are not applications themselves and are generally shared between applications.
CoreServices/ | Contains system applications, such as SystemStarter, BootX, the Finder, and the login window.
Displays/ | Contains ColorSync information for external monitors.
DTDs/ | Contains document type definitions for XML documents used by the system, such as property lists.
Extensions/ | Holds Darwin kernel extensions.
Extensions.kextcache | Contains information about extensions in the cache; a compressed XML document.
Extensions.mkext | Contains the kernel extension cache. It is created at boot by /etc/rc.
Filesystems/ | Contains drivers and utilities for various filesystems (MS-DOS, AppleShare, UFS, etc.).
Find/ | Includes support files for Sherlock's content indexing.
Fonts/ | Contains core Mac OS X fonts.
Frameworks/ | Holds a collection of reusable application frameworks, including shared libraries, headers, and documentation.
Image Capture/ | Contains device support files for the Image Capture application.
Java/ | Contains Java class and jar files.
Keyboard Layouts/ | Contains bundles that support internationalized keyboard layouts.
Keyboards/ | Contains keyboard mappings.
Keychains/ | Contains system-wide keychain files. (~/Library/Keychains contains per-user keychains.)
LoginPlugins/ | Contains helper applications that are launched as you log in.
Modem Scripts/ | Contains modem configuration scripts.
MonitorPanels/ | Includes panels used by System Preferences Displays.
OpenSSL/ | Holds OpenSSL configuration and support files.
Perl/ | Holds Perl Libraries.
PHP/ | Contains PHP Libraries.
PreferencePanes/ | Contains all the preference panes for the Preferences application.
Printers/ | Contains printer support files.
PrivateFrameworks/ | Holds private frameworks meant to support Mac OS X. These frameworks are not meant for programmers' use.
QuickTime/ | Holds QuickTime support files.
QuickTimeJava/ | Includes support files for the QuickTime/Java bridge.
Rulebooks/ | Contains information used for text handling, such as word-breaking rules for hyphenation.
Screen Savers/ | Contains screensavers that you can select from System Preferences Screen Saver.
ScriptingAdditions/ | Includes AppleScript plug-ins and libraries.
Server Settings/ | Contains plug-ins for the Server Settings utility. Mac OS X Server only.
ServerSetup/ | Contains support files used when setting the initial server configuration. Mac OS X Server only.
Services/ | Contains services that are made available through the Services menu.
Sounds/ | Contains sounds that are available in System Preferences Sound.
Speech/ | Includes speech recognition and generation support files.
StartupItems/ | Contains startup scripts as described in Chapter 2.
SystemConfiguration/ | Contains plug-ins used to monitor various system activities (for Apple use only).
SystemResources/ | Contains precompiled header lists for the C compiler (see Section 5.1.1).
Tcl/ | Holds Tcl libraries.
TextEncodings/ | Contains localized text encodings.
User Template/ | Lists localized skeleton files for user directories. See Section 3.8.3.

### A.1.3. The /Library Directory

Table A-4 lists the contents of the /Library directory. This directory contains counterparts to many directories found in /System/Library. You can use the /Library counterparts for system-wide customization. If you find a directory of the same name in your home Library directory (~/Library), you can use that for user-level customization. For example, you can install fonts for one particular user by moving them into ~/`username`/Library/Fonts.

#### Table A-4. The /Library directory

File or directory | Description
--- | ---
Application Support/ | Contains support files for locally installed applications.
Audio/ | Contains audio plug-ins and sounds.
Authenticators/ | Contains authentication code for locally installed applications.
Caches/ | Contains cached data used by various parts of the operating system.
CFMSupport/ | Holds shared libraries used by Carbon applications.
ColorSync/ | Contains user-installed ColorSync profiles and scripts.
Desktop Pictures/ | Contains desktop pictures used by System Preferences Desktop.
Documentation/ | Provides documentation for locally installed applications.
FTPServer/ | Contains configuration files and the root folder of anonymous FTP server. Mac OS X Server only.
Filesystems/ | Contains authentication support for the Apple Share network client.
Fonts/ | Contains locally installed fonts.
Image Capture/ | Contains locally installed scripts and plug-ins for the Image Capture application.
Internet Plug-Ins/ | Contains locally installed browser plug-ins.
Java/ | Contains locally installed Java classes (you can drop jar files into /Library/Java/Extensions), as well as a suitable directory to use as your `$JAVA_HOME` (/Library/Java/Home).
Keyboard Layouts/ | Contains keyboard mappings.
Logs/ | Holds logs for services such as Apple File Services, the Crash Reporter, and the Directory Service.
Macintosh Manager/ | Contains support files for the Macintosh Manager application (Mac OS X Server only).
Modem Scripts/ | Holds support files for various modem types.
Perl/ | Lists locally installed Perl modules (MakeMaker's `INSTALLSITELIB`).
PreferencePanes/ | Contains system preference panes for locally installed utilities such as TinkerTool.
Preferences/ | Lists global preferences.
Printers/ | Lists printer drivers and utilities.
QuickTime/ | Contains locally installed QuickTime components.
QuickTimeStreaming/ | Contains the QuickTime Streaming Server (Mac OS X Server only).
Receipts/ | Leaves a receipt in the form of a .pkg directory after you install an application with the Mac OS X installer. The .pkg directory contains a bill of materials file (.bom), which you can read with the lsbom command.
Screen Savers/ | Lists locally installed screensavers.
Scripts/ | Contains a variety of AppleScripts installed with Mac OS X.
StartupItems/ | Lists locally installed startup items. See Section 2.2.
Tomcat/ | Holds the Apache Tomcat Java Servlet and JSP server (Mac OS X Server only).
User Pictures/ | Contains user pictures that are used in the login panel.
WebServer/ | Contains the Apache CGI and document root directories.

### A.1.4. The /var Directory

The /var directory contains transient and volatile files, such as PID files (which tell you the process ID of a currently running daemon), log files, and many others. Table A-5 lists the contents of the /var directory.

#### Table A-5. The /var directory

File or directory | Description
--- | ---
at/ | Contains information about jobs scheduled with the at command.
backups/ | Contains backups of the NetInfo database.
cron/ | Contains user crontab files.
db/ | Includes a grab bag of configuration and data files, including the locate database, the NetInfo database, and network interface information.
empty/ | Description not available at time of writing; see errata page at http://www.oreilly.com/catalog/mosxgeeks.
log/ | Contains a variety of log files, including syslog, mail, and web server logs.
mail/ | Contains inboxes for local users' email.
msgs/ | Holds system-wide messages that were delivered using msgs -s.
named/ | Includes various files used for local DNS services.
netboot/ | Contains various files used for NetBoot.
root/ | Serves as the root user's home directory.
run/ | Holds PID files for running processes. Also contains working files used by programs such as sudo.
rwho/ | Contains information used by the rwho command.
servermgrd/ | Contains runtime files used by the Server Manager daemon. Mac OS X Server only.
spool/ | Serves as a spool directory for mail, printer queues, and other queued resources.
tmp/ | Serves as a temporary file directory.
vm/ | Contains your swap files.
yp/ | Contains files used by NIS.

### A.1.5. The /dev Directory

The /dev directory contains files that represent devices attached to the system, including physical devices, such as serial ports, and pseudodevices, such as a random number generator. Table A-6 lists the contents of the /dev directory.

#### Table A-6. The /dev directory

File or directory | Description
--- | ---
bpf[0-3] | Berkeley Packet Filter devices. See bpf(4).
console | The system console. This is owned by whoever is currently logged in. If you write to it, the output will end up in /var/tmp/console.log, which you can view with the Console application (/Applications/Utilities).
cu.modem | Modem device for compatibility with the Unix cu (call up) utility.
disk[0-n] | Disk.
disk[0-n]s[0-n] | Disk partition. For example, /dev/disk0s1 is the first partition of /dev/disk0.
fd/ | Devices that correspond to file descriptors. See the fd manpage for more details.
klog | Device used by syslogd to read kernel messages.
kmem | Image of kernel memory.
mem | Image of the system memory.
null | Bit bucket. You can redirect anything here, and it will disappear.
ptyp[0-f] | Master ends of the first sixteen pseudo-ttys.
pty[q-w][0-f] | Master ends of the remaining pseudo-ttys.
random | Source of pseudorandom data. See random(4).
rdisk[0-n] | Raw disk device.
rdisk[0-n]s[0-n] | Raw disk partition.
stderr | Symbolic link to /dev/fd/2.
stdin | Symbolic link to /dev/fd/0.
stdout | Symbolic link to /dev/fd/1.
tty | Standard output stream of the current Terminal or remote login.
tty.modem | Modem device.
ttyp[0-f] | Slave ends of the first sixteen pseudo-ttys.
tty[q-w][0-f] | Slave ends of the remaining pseudo-ttys.
urandom | Source of pseudorandom data, not guaranteed to be strong. See random(4).
vn[0-3] | Pseudo disk devices.
zero | Infinite supply of null characters. Often used with dd to create a file made up of null characters.

Copyright © 2003 O'Reilly & Associates. All rights reserved.