A.1 Files and Directories

Table A-1 describes the files and directories you may find in your root directory. The remaining tables in this chapter describe significant subdirectories.

Table A-1. Mac OS X's root directory

File or directory	Description
.DS_Store	Contains Finder settings, such as icon location and window size. The file will appear in any directory that you've viewed with the Finder.
.hidden	Contains a list of files that should be invisible to the Finder.
.hotfiles.btree	Used by Panther's Hot File Adaptive Clustering, which automatically defragments frequently accessed files that are under 20 MB in size.
.Trashes/	Contains files that have been dragged to the Trash. On a boot volume, such files are stored in ~/.Trash . On a non-boot volume, these files are in /.Trashes/uid/ .
.vol/	Maps HFS+ file IDs to files. If you know a file's ID, you can open it using /.vol/id .
Applications/	Holds all your Mac OS X applications. Its Utilities subdirectory includes lots of useful things, such as the Terminal, Console, and the Activity Monitor.
Applications (Mac OS 9)/	Contains all your OS 9 applications, if you've got Mac OS X and Mac OS 9 installed.
automount/	Handles static NFS mounts for the automount daemon.
bin/	Contains essential system binaries.
Desktop DB	Along with Desktop DF , contains the desktop database that is rebuilt when you click Rebuild Desktop in System Preferences Classic.
botlib.log	Quake III players have this.
cores/	A symbolic link (or symlink ) to /private/cores . If core dumps are enabled (with tcsh 's limit and bash / sh 's ulimit commands ”see the tcsh and bash manpages for more details), they will be created in this directory as core.pid .
Desktop DF	See Desktop DB.
Desktop Folder/	The Mac OS 9 desktop folder.
dev/	Contains files that represent various devices. See Table A-6.
Developer/	Contains Apple's Xcode Tools and documentation. Available only if you have installed the Xcode Tools.
Documents/	The Mac OS 9 documents folder.
etc/	Contains system configuration files. See Table A-2. The directory is a symbolic link to /private/etc .
Installer Log File	May be left by some third-party application installers .
Library/	Contains support files for locally installed applications, among other things. See Table A-4.
lost+found	Stores orphaned files discovered by fsck .
mach	A symbolic link to the /mach.sym file.
mach.sym	Contains kernel symbols. It is generated during each boot by /etc/rc .
mach_kernel	The Darwin kernel.
Network/	Contains network-mounted Application , Library , and Users directories, as well as a Servers directory, which contains directories mounted by the automount daemon.
private/	Contains the tmp , var , etc , and cores directories.
sbin/	Contains executables for system administration and configuration.
sw/	Contains the Fink installation (see Chapter 11).
Shared Items/	Gives OS 9 multiuser systems a place where users can store files for other users to access.
System/	Contains a subdirectory, Library , which holds support files for the system and system applications, among other things. See Table A-3.
System Folder/	The Mac OS 9 System Folder.
Temporary Items/	Contains temporary files used by Mac OS 9.
TheVolumeSettingsFolder/	Keeps track of details such as open windows and desktop printers.
tmp/	Holds temporary files. It is a symbolic link to /private/tmp .
Trash/	Where Mac OS 9 stores deleted files until the Trash is emptied.
User Guides And Information/	An alias to /Library/Documentation/User Guides and Information , and contains hardware-specific documentation and information about Panther.
Users/	Contains home directories for the users on the system. The root user's home directory is /var/root .
usr/	Contains BSD Unix applications and support files.
var/	Contains frequently modified files, such as log files. It is a symbolic link to /private/var .
VM Storage	Mac OS 9 virtual memory file.
Volumes /	Contains all mounted filesystems, including removable media and mounted disk images.

A.1.1 The /etc Directory

The /etc directory contains configuration files for Unix applications and services, as well as scripts that control system startup. Table A-2 lists the contents of the /etc directory.

Table A-2. The /etc directory

File or directory	Description
6to4.conf	Configuration file for encapsulating IPv6 within IPv4. See ip6config(8) .
afpovertcp.cfg	Causes Mac OS X to use TCP/IP as the default transport for Apple File Protocol (AFP). Use this file to configure the defaults for AFP over TCP/IP.
aliases	Mail aliases file. Symbolic link to /etc/postfix/aliases .
aliases.db	Mail aliases db file created when you run newaliases .
amd.conf.template	Sample configuration file for the automount daemon.
amd.map.template	Sample map file for the automount daemon.
auth/	Contains an Open Directory authentication module for Samba.
appletalk.cfg	AppleTalk configuration file for routing or multihoming. See the appletalk.cfg(5) manpage .
authorization	Controls how applications, such as installers, can temporarily obtain root privileges.
authorization.cac	Description unavailable at time of printing. Please see the errata at http://www.oreilly.com/catalog/mpantherunix/.
bashrc	Global configuration file for bash , the Bourne-again shell.
charset/	Contains localization files.
crontab	root 's crontab . See Section 2.3.1 in Chapter 2.
csh. cshrc	Global csh configuration file, processed when the shell starts up. If you have a .cshrc or .tcshrc file in your home directory, tcsh will execute its contents as well.
csh.login	Global csh login file, processed when a login shell starts up. If you have a .login file in your home directory, tcsh will execute its contents as well.
csh.logout	Global csh logout file, processed when a user logs out of a login shell.
cups/	Contains configuration files for Common Unix Printing System (CUPS).
daily	cron job that is run once a day (see crontab ). This is a symlink to /etc/periodic/daily/ 500.daily .
defaults/	Contains default configuration files for applications and utilities.
dumpdates	Dump date records created by dump(5) , which is run by /etc/daily .
find.codes	Description not available at time of writing; see errata page at http://www.oreilly.com/catalog/mpantherunix.
fonts/	Configures fonts for X11.
fstab	Specifies filesystems that you want to mount at startup. See the comments in the file for examples.
fstab.hd	Unused.
ftpusers	List of users who are prohibited from using FTP.
gdb.conf	Global gdb configuration file.
gettytab	Terminal configuration database.
group	Group permissions file. See Chapter 3.
hostconfig	System configuration file that controls many of the startup items described in Section 2.1.5 in Chapter 2.
hosts	Host database; a mapping of IP addresses to hostnames. You can use this as a supplement to other Directory Services, such as DNS. Mac OS X 10.1 and earlier consulted this file only in single-user mode, but Mac OS X 10.2 (Jaguar) uses this file at other times. For more information, see Chapter 3.
hosts.equiv	List of trusted remote hosts and host-user pairs. This is used by rsh and is inherently insecure . You should use ssh instead, which is a secure alternative. See ssh-keygen(1) to generate key pairs that can be used to set up a trust relationship with remote users.
hosts.lpd	List of hosts that are allowed to connect to the Unix lpd service.
httpd/	Contains Apache's configuration files.
idmap/	Description unavailable at time of printing. Please see the errata at http://www.oreilly.com/catalog/mpantherunix/.
inetd.conf	Internet super-server ( inetd ) configuration file.
kcpassword	Description unavailable at time of printing. Please see the errata at http://www.oreilly.com/catalog/mpantherunix/.
kern_loader.conf	Description unavailable at time of printing. Please see the errata at http://www.oreilly.com/catalog/mpantherunix/.
localtime	Symbolic link to your system's time zone, such as: /usr/share/zoneinfo/US/Eastern .
lowcase .dat	Used by Samba to determine lowercase characters for various locales.
mail/	Contains configuration files for sendmail . Note that Open Directory handles the mail aliases (see Chapter 3).
mach_init.d/	Mach bootstrap daemons. See Chapter 2.
mach_init_per_user.d/	Per-user Mach bootstrap daemons. See Chapter 2.
mail.rc	Global configuration file for /usr/bin/mail .
manpath .config	Configuration file for man .
master.passwd	Shadow passwd file, consulted only in single-user mode. During normal system operation, Open Directory manages user information (see Chapter 3).
moduli	System-wide prime numbers used for cryptographic applications such as ssh .
monthly	Monthly cron job (see crontab ); a symlink to /etc/periodic/monthly/500. monthly .
motd	Message of the day; displayed each time you launch a new Terminal or log in remotely.
named.conf	Configuration file for named , the DNS daemon. For more details, see named(8) .
networks	Network name database.
notify.conf	Configuration for the Notification Center.
ntp.conf	Configuration file for the Network Time Protocol daemon, which synchronizes system time by accessing a remote server.
openldap/	Contains configuration files for OpenLDAP, an implementation of the Lightweight Directory Access Protocol.
pam.d/	Contains configuration files for PAM.
passwd	Password file. For more information, see Chapter 3.
pdb/	Contains an Open Directory authentication module for Samba.
periodic/	Contains configuration files for the periodic utility, which runs cron jobs on a regular basis.
ppp/	Contains configuration files for Point-To-Point Protocol (PPP).
printcap	Printer configuration file for lpd . CUPS automatically generates this file. For more information, see cupsd(8) .
profile	Global profile for the Bourne-again shell.
protocols	Network protocol database.
racoon /	Contains configuration files for racoon , the IKE key management daemon.
rc	Startup script for multiuser mode.
rc.boot	Startup script for single-user mode.
rc.cleanup	Cleanup script invoked by /etc/rc .
rc.common	Common settings for startup scripts.
rc.netboot	Startup script for booting from the network using NetBoot.
resolv.conf	DNS resolver configuration. Symlink to /var/run/resolv.conf .
resolver/	Contains files used to resolve hostnames.
rmt	Symbolic link to /usr/sbin/rmt .
rmtab	Remote NFS mount table.
rpc	RPC number-to-name mappings. Mac OS X 10.1 and earlier consulted this file only in single-user mode, but Mac OS X 10.2 (Jaguar) uses this file at other times. For more information, see Chapter 3.
rtadvd.conf	Configuration file for the router advertisement daemon. For more details, see rtadvd(8) .
services	Internet service name database. Mac OS X 10.1 and earlier consulted this file only in single-user mode, but Mac OS X 10.2 (Jaguar) uses this file at other times. For more information, see Chapter 3.
shells	List of shells.
slpsa.conf	Configuration file for the service locator daemon ( slpd ).
smb.conf	Samba configuration file.
smb.conf.template	Template configuration file for Samba.
ssh_config	Global configuration file for OpenSSH client programs.
ssh_host_dsa_key	Private DSA host key for OpenSSH. This file, and the other ssh_host_* files, are created the first time you start Remote Login in the Sharing System Preferences.
ssh_host_dsa_key.pub	Public DSA host key for OpenSSH.
ssh_host_key	Private host key for OpenSSH when using SSH 1 compatibility.
ssh_host_key.pub	Public host key for OpenSSH when using SSH 1 compatibility.
ssh_host_rsa_key	Private RSA host key for OpenSSH.
ssh_host_rsa_key.pub	Public RSA host key for OpenSSH.
sshd_config	Configuration file for the OpenSSH sshd daemon.
sudoers	Configuration file for the sudo command. Make sure you use the visudo command only to edit this file.
syslog.conf	syslogd configuration file.
ttys	Terminal initialization file.
upcase .dat	Used by Samba to determine uppercase characters for various locales.
valid.dat	Used by Samba to determine valid characters for various locales.
vfs/	Description unavailable at time of printing. Please see the errata at http://www.oreilly.com/catalog/mpantherunix/.
weekly	Weekly cron job (see crontab ). This is a symlink to /etc/periodic/weekly/500.weekly .
X11/	X11 configuration directory. This file is present only if you have installed X11.
xinetd.conf	Configuration file for xinetd , the extended Internet superserver daemon.
xinetd.d/	Contains service-specific configuration files for xinetd .
xtab	Lists current NFS exports.

A.1.2 The /System/Library Directory

Table A-3 lists the directories stored under the /System/Library directory. You should not modify the contents of these directories or add new files to them. Instead, use their counterparts in the /Library folder. For example, to install a new font, drag it into /Library/Fonts , not /System/Library/Fonts .

Table A-3. The /System/Library directory

File or directory	Description
Caches/	Contains caches used by various parts of the operating system.
CFMSupport/	Holds shared libraries used by Carbon applications.
Classic/	Description unavailable at time of printing. Please see the errata at http://www.oreilly.com/catalog/mpantherunix/.
ColorPickers/	Includes localized resources for Mac OS X color pickers.
Colors/	Contains the names and values of colors used in the color picker control.
ColorSync/	Contains ColorSync profiles.
Components /	Contains application building blocks (components), such as AppleScript and color pickers. Components are not applications themselves and are generally shared between applications.
Contextual Menu Items/	Contains plug-ins for the Finder's contextual menu (Control-click or Right-click).
CoreServices/	Contains system applications, such as SystemStarter , BootX , the Finder, and the login window.
Displays/	Contains ColorSync information for external monitors .
DTDs/	Contains document type definitions for XML documents used by the system, such as property lists.
Extensions/	Holds Darwin kernel extensions.
Extensions.kextcache	Contains information about extensions in the cache; a compressed XML document.
Extensions.mkext	Contains the kernel extension cache. It is created at boot by /etc/rc .
Filesystems/	Contains drivers and utilities for various filesystems (MS-DOS, AppleShare, UFS, etc.).
Filters/	Contains Quartz Filters that are used in the Print dialog's ColorSync section.
Find/	Includes support files for Sherlock's content indexing.
Fonts/	Contains core Mac OS X fonts.
Frameworks/	Holds a collection of reusable application frameworks, including shared libraries, headers, and documentation.
Image Capture/	Contains device support files for the Image Capture application.
Java/	Contains Java class and jar files.
Keyboard Layouts/	Contains bundles that support internationalized keyboard layouts.
Keychains/	Contains system-wide keychain files.
LoginPlugins/	Contains helper applications that are launched as you log in.
Modem Scripts/	Contains modem configuration scripts.
MonitorPanels/	Includes panels used by System Preferences Displays.
OpenSSL/	Holds OpenSSL configuration and support files.
Perl/	Holds Perl Libraries.
PHP/	Contains PHP Libraries.
PreferencePanes/	Contains all the preference panes for the Preferences application.
Printers/	Contains printer support files.
PrivateFrameworks/	Holds private frameworks meant to support Mac OS X. These frameworks are not meant for programmers' use.
QuickTime/	Holds QuickTime support files.
QuickTimeJava/	Includes support files for the QuickTime/Java bridge.
Rulebooks/	Contains information used for text handling, such as word-breaking rules for hyphenation.
Screen Savers/	Contains screensavers that you can select from System Preferences Desktop & Screen Saver.
ScriptingAdditions/	Includes AppleScript plug-ins and libraries.
Services/	Contains services that are made available through the Services menu.
Sounds/	Contains sounds that are available in System Preferences Sound.
Speech/	Includes speech recognition and generation support files.
StartupItems/	Contains startup scripts as described in Chapter 2.
SyncServices/	Contains iSync conduits .
SystemConfiguration/	Contains plug-ins used to monitor various system activities (for Apple use only).
SystemProfiler/	Contains support files for System Profiler.
SystemResources/	Contains precompiled header lists for the C compiler (see "Precompiled Header Files" in Chapter 9).
TextEncodings/	Contains localized text encodings.
User Template/	Holds localized skeleton files for user directories. See "Creating a User's Home Directory" in Chapter 3.

A.1.3 The /Library Directory

Table A-4 lists the contents of the /Library directory. This directory contains counterparts to many directories found in /System/Library . You can use the /Library counterparts for system-wide customization. If you find a directory of the same name in your home Library directory ( ~/Library ), you can use that for user-level customization. For example, you can install fonts for one particular user by moving them into ~/ Library/Fonts .

Table A-4. The /Library directory

File or directory	Description
Address Book Plug-Ins	Contains plug-ins for the Address Book application.
Application Support/	Contains support files for locally installed applications.
Audio/	Contains audio plug-ins and sounds.
Caches/	Contains cached data used by various parts of the operating system.
CFMSupport/	Holds shared libraries used by Carbon applications.
ColorSync/	Contains user-installed ColorSync profiles and scripts.
Contextual Menu Items/	Contains plug-ins for the Finder's contextual menu (Control-Click or Right-Click).
Desktop Pictures/	Contains desktop pictures used by System Preferences Desktop & Screen Saver.
Documentation/	Provides documentation for locally installed applications.
Filesystems/	Contains authentication support for the Apple Share network client.
Fonts/	Contains locally installed fonts.
Image Capture/	Contains locally installed scripts and plug-ins for the Image Capture application.
Internet Plug-Ins/	Contains locally installed browser plug-ins.
iTunes/	Holds iTunes plug-ins.
Java/	Contains locally installed Java classes (you can drop jar files into /Library/Java/Extensions ), as well as a suitable directory to use as your $JAVA_HOME ( /Library/Java/ Home ).
Keyboard Layouts/	Contains keyboard mappings.
Keychains/	Contains keychain files.
Logs/	Holds logs for services such as Apple File Services, the Crash Reporter, and the Directory Service.
Modem Scripts/	Holds support files for various modem types.
Packages/	Description unavailable at time of printing. Please see the errata at http://www.oreilly.com/catalog/mpantherunix/.
Perl/	Contains locally installed Perl modules (MakeMaker's INSTALLSITELIB ).
PreferencePanes/	Contains system preference panes for locally installed utilities such as TinkerTool.
Preferences/	Holds global preferences.
Printers/	Contains printer drivers and utilities.
Python/	Contains locally installed Python modules.
QuickTime/	Contains locally installed QuickTime components.
Receipts/	Leaves a receipt in the form of a .pkg directory after you install an application with the Mac OS X installer. The .pkg directory contains a bill of materials file ( .bom ), which you can read with the lsbom command.
Screen Savers/	Contains locally installed screensavers.
Scripts/	Contains a variety of AppleScripts installed with Mac OS X.
StartupItems/	Holds locally installed startup items. See Section 2.2 in Chapter 2.
User Pictures/	Contains user pictures that are used in the login panel.
WebServer/	Contains the Apache CGI and document root directories.

A.1.4 The /var Directory

The /var directory contains transient and volatile files, such as PID files (which tell you the process ID of a currently running daemon), log files, and many others. Table A-5 lists the contents of the /var directory.

Table A-5. The /var directory

File or directory	Description
at/	Contains information about jobs scheduled with the at command.
automount	Contains information about servers and volumes that have been browsed on the network.
backups /	Contains backups of the NetInfo database.
cron/	Contains user crontab files.
db/	Includes a grab bag of configuration and data files, including the locate database, the NetInfo database, and network interface information.
empty/	Used as an unwritable chroot(8) environment.
log/	Contains a variety of log files, including syslog , mail, and web server logs.
mail/	Contains inboxes for local users' email.
msgs/	Holds system-wide messages that were delivered using msgs -s .
named/	Includes various files used for local DNS services.
netboot/	Contains various files used for NetBoot.
root/	Serves as the root user's home directory.
run/	Holds PID files for running processes. Also contains working files used by programs such as sudo .
rwho/	Contains information used by the rwho command.
slp.regfile	List of servers found with Service Location Protocol (SLP).
spool/	Serves as a spool directory for mail, printer queues, and other queued resources.
tmp/	Serves as a temporary file directory.
vm/	Contains your swap files.
yp/	Contains files used by NIS.

A.1.5 The /dev Directory

The /dev directory contains files that represent devices attached to the system, including physical devices, such as serial ports, and pseudodevices, such as a random number generator. Table A-6 lists the contents of the /dev directory.

Table A-6. The /dev directory

File or directory	Description
bpf[0-3]	Berkeley Packet Filter devices. See bpf(4) .
console	The system console. This is owned by whoever is currently logged in. If you write to it, the output will end up in /var/tmp/console.log , which you can view with the Console application ( /Applications/Utilities ).
cu.*	Modem devices for compatibility with the Unix cu (call up) utility.
disk[0-n]	Disk.
disk[0-n]s[0-n]	Disk partition. For example, /dev/disk0s1 is the first partition of /dev/disk0 .
fd/	Devices that correspond to file descriptors. See the fd manpage for more details.
klog	Device used by syslogd to read kernel messages.
kmem	Image of kernel memory.
mem	Image of the system memory.
null	Bit bucket. You can redirect anything here, and it will disappear.
ptyp[0-f]	Master ends of the first sixteen pseudo- tty s.
pty[q-w][0-f]	Master ends of the remaining pseudo- tty s.
random	Source of pseudorandom data. See random(4) .
rdisk[0-n]	Raw disk device.
rdisk[0-n]s[0-n]	Raw disk partition.
stderr	Symbolic link to /dev/fd/2 .
stdin	Symbolic link to /dev/fd/0 .
stdout	Symbolic link to /dev/fd/1 .
tty	Standard output stream of the current Terminal or remote login.
tty.*	Various modem and serial devices.
ttyp[0-f]	Slave ends of the first sixteen pseudo- tty s.
tty[q-w][0-f]	Slave ends of the remaining pseudo- tty s.
urandom	Source of pseudorandom data, not guaranteed to be strong. See random(4) .
vn[0-3]	Pseudo disk devices.
zero	Infinite supply of null characters. Often used with dd to create a file made up of null characters.