3.2. Files and Directories

If you do an ls -a / on your Tiger system, you'll see some familiar things, such as /etc and /var, but you'll also notice some unfamiliar things, such as /TheVolumeSettingsFolder, /Library, and /Documents. Mac OS X's filesystem contains traces of Unix, NeXTSTEP, and Mac OS 9. The tables in the rest of this chapter list directory entries and provide a description of each file or directory.

Table 3-1 describes the files and directories (indicated with a trailing slash) you may find in your / (the root) directory. The remaining tables in this chapter describe significant subdirectories.

Table 3-1. Mac OS X's root directory

File or directory	Description
.DS_Store	Contains Finder settings, such as icon location and window size. The file will appear in any directory that you've viewed with the Finder.
.Spotlight-V100/	Contains metadata used by Spotlight. For more information, see Chapter 2.
.Trashes/	Contains files that have been dragged to the Trash. On a boot volume, such files are stored in ~/.Trash. On a non-boot volume, these files are in /.Trashes/uid/.
.vol/	Maps HFS+ file IDs to files. If you know a file's ID, you can open it using /.vol/id.
Applications/	Holds all your Mac OS X applications. Its Utilities subdirectory includes lots of useful things, such as the Terminal, Console, and the Activity Monitor.
Applications (Mac OS 9)/	Contains all your OS 9 applications if you've got Mac OS X and Mac OS 9 installed.
automount/	Handles static NFS mounts for the automount daemon.
bin/	Contains essential system binaries.
botlib.log	Quake III players have this.
cores/	A symbolic link (or symlink) to /private/cores. If core dumps are enabled (with tcsh's limit and bash/sh's ulimit commands see the tcsh and bash manpages for more details) they are created in this directory as core.pid.
Desktop DB	Along with Desktop DF, contains the desktop database that is rebuilt when you click Rebuild Desktop in System Preferences Classic.
Desktop DF	See Desktop DB.
Desktop Folder/	The Mac OS 9 desktop folder.
dev/	Contains files that represent various devices. See Table 3-6.
Developer/	Contains Apple's Xcode Tools and documentation. Available only if you have installed the Xcode Tools.
Documents/	The Mac OS 9 documents folder.
etc/	Contains system configuration files. See Table 3-2. The directory is a symbolic link to /private/etc.
Installer Log File	May be left by some third-party application installers.
Library/	Contains support files for locally installed applications, among other things. See Table 3-4.
lost+found	Stores orphaned files discovered by fsck. You'll only find this on UFS volumes.
mach	A symbolic link to the /mach.sym file.
mach.sym	Contains kernel symbols. It is generated during each boot by /etc/rc.
mach_kernel	The Darwin kernel.
Network/	Contains network-mounted Application, Library, and Users directories, as well as a Servers directory, which contains directories mounted by the automount daemon.
private/	Contains the tmp, var, etc, and cores directories.
sbin/	Contains executables for system administration and configuration.
sw/	Contains the Fink installation (see Chapter 13).
Shared Items/	Gives OS 9 multiuser systems a place where users can store files for other users to access.
System/	Contains a subdirectory, Library, which holds support files for the system and system applications, among other things. See Table 3-3.
System Folder/	The Mac OS 9 System Folder.
Temporary Items/	Contains temporary files used by Mac OS 9.
TheFindByContentFolder/	Created by Sherlock 2 (the Classic version).
TheVolumeSettingsFolder/	Keeps track of shared volume details, such as open windows and desktop printers.
tmp/	Holds temporary files. It is a symbolic link to /private/tmp.
Trash/	Where Mac OS 9 stores deleted files until the Trash is emptied.
User Guides And Information/	An alias to /Library/Documentation/User Guides and Information, and contains hardware-specific documentation and information about Mac OS X.
Users/	Contains home directories for the users on the system. The root user's home directory is /var/root.
usr/	Contains BSD Unix applications and support files.
var/	Contains frequently modified files, such as log files. It is a symbolic link to/private/var.
VM Storage	Mac OS 9 virtual memory file.
Volumes/	Contains all mounted filesystems, including removable media and mounted disk images.

3.2.1. The /etc Directory

The /etc directory contains configuration files for Unix applications and services, as well as scripts that control system startup. Table 3-2 lists the contents of the /etc directory.

Table 3-2. The /etc directory

File or directory	Description
6to4.conf	Configuration file for encapsulating IPv6 within IPv4. See ip6config(8).
afpovertcp.cfg	Causes Mac OS X to use TCP/IP as the default transport for Apple File Protocol (AFP). Use this file to configure the defaults for AFP over TCP/IP.
aliases	Mail aliases file. Symbolic link to /etc/postfix/aliases.
aliases.db	Mail aliases db file created when you run newaliases.
appletalk.cfg	AppleTalk configuration file for routing or multihoming. See the appletalk.cfg(5) manpage.
authorization	Controls how applications, such as installers, can temporarily obtain root privileges.
authorization.cac	Undocumented.
bashrc	Global configuration file for bash, the Bourne-again shell.
crontab	root's crontab.
csh.cshrc	Global csh configuration file, processed when the shell starts up. If you have a .cshrc or .tcshrc file in your home directory, tcsh executes its contents as well.
csh.login	Global csh login file, processed when a login shell starts up. If you have a .login file in your home directory, tcsh will execute its contents as well.
csh.logout	Global csh logout file, processed when a user logs out of a login shell.
cups/	Contains configuration files for Common Unix Printing System (CUPS).
daily	cron job that is run once a day (see crontab). This is a symlink to /etc/periodic/daily/ 500.daily.
defaults/	Contains default configuration files for applications and utilities.
dumpdates	Dump date records created by dump(5), which is run by /etc/daily.
efax.rc	Configuration file for fax(1).
find.codes	Undocumented.
fonts/	Configures fonts for X11.
fstab.hd	Undocumented.
ftpusers	List of users who are prohibited from using FTP.
gdb.conf	Global gdb configuration file.
gettytab	Terminal configuration database.
group	Group permissions file. See Chapter 5.
hostconfig	System configuration file that controls many of the startup items described in Chapter 3.
hosts	Host database; a mapping of IP addresses to hostnames. You can use this as a supplement to other Directory Services, such as DNS. Mac OS X 10.1 and earlier consulted this file only in single-user mode, but as of Mac OS X 10.2 (Jaguar), this file is used at other times. For more information, see Chapter 5.
hosts.equiv	List of trusted remote hosts and host-user pairs. This is used by rsh and is inherently insecure. You should use ssh instead, which is a secure alternative. See ssh-keygen(1) to generate key pairs that can be used to set up a trust relationship with remote users.
hosts.lpd	List of hosts that are allowed to connect to the Unix lpd service.
httpd/	Contains Apache's configuration files.
inetd.conf	Internet super-server (inetd) configuration file.
kcpassword	Stores an encrypted version of a user's password for auto-login.
kern_loader.conf	Mach's kernel server loader configuration file. Empty in the current version of Mac OS X.
localtime	Symbolic link to your system's time zone, such as: /usr/share/zoneinfo/US/Eastern.
mach_init.d/	Mach bootstrap daemons. See Chapter 4.
mach_init_per_user.d/	Per-user Mach bootstrap daemons. See Chapter 4.
mail.rc	Global configuration file for /usr/bin/mail.
master.passwd	Shadow passwd file, consulted only in single-user mode. During normal system operation, Open Directory manages user information (see Chapter 5).
memberd.conf	Configuration file for the group membership resolution daemon, memberd(8).
moduli	System-wide prime numbers used for cryptographic applications such as ssh.
monthly	Monthly cron job (see crontab); a symlink to /etc/periodic/monthly/500. monthly.
motd	Message of the day; displayed each time you launch a new Terminal or log in remotely.
named.conf	Configuration file for named, the DNS daemon. For more details, see named(8).
nanorc	Configuration file for the nano text editor.
networks	Network name database.
notify.conf	Configuration for the Notification Center.
openldap/	Contains configuration files for OpenLDAP, an implementation of the Lightweight Directory Access Protocol.
pam.d/	Contains configuration files for PAM.
passwd	Password file. For more information, see Chapter 5.
pear.conf	Configuration file for pear, the PHP Extension and Application Repository.
periodic/	Contains configuration files for the periodic utility, which runs cron jobs on a regular basis.
php.ini.default	Default PHP initialization file.
postfix/	Contains postfix configuration files.
ppp/	Contains configuration files for Point-To-Point Protocol (PPP).
printcap	Printer configuration file for lpd. CUPS automatically generates this file. For more information, see cupsd(8).
profile	Global profile for the Bourne-again shell.
protocols	Network protocol database.
racoon/	Contains configuration files for racoon, the IKE key management daemon.
rc	Startup script for multiuser mode.
rc.common	Common settings for startup scripts.
rc.netboot	Startup script for booting from the network using NetBoot.
rc.shutdown	System shutdown script.
resolv.conf	DNS resolver configuration. Symlink to /var/run/resolv.conf.
rmtab	Remote NFS mount table.
rpc	RPC number-to-name mappings. Mac OS X 10.1 and earlier consulted this file only in single-user mode, but newer versions of Mac OS X use this file at other times.
rtadvd.conf	Configuration file for the router advertisement daemon. For more details, see rtadvd(8).
services	Internet service name database. Mac OS X 10.1 and earlier consulted this file only in single-user mode, but Mac OS X 10.2 (Jaguar) uses this file at other times. For more information, see Chapter 5.
shells	List of shells.
slpsa.conf	Configuration file for the service locator daemon (slpd).
smb.conf	Samba configuration file.
smb.conf.template	Template configuration file for Samba.
snmpd.conf	Configuration file for the ucd-snmp snmpd agent.
ssh_config	Global configuration file for OpenSSH client programs.
ssh_host_dsa_key	Private DSA host key for OpenSSH. This file, and the other ssh_host_* files, are created the first time you start Remote Login in the Sharing System Preferences.
ssh_host_dsa_key.pub	Public DSA host key for OpenSSH.
ssh_host_key	Private host key for OpenSSH when using SSH 1 compatibility.
ssh_host_key.pub	Public host key for OpenSSH when using SSH 1 compatibility.
ssh_host_rsa_key	Private RSA host key for OpenSSH.
ssh_host_rsa_key.pub	Public RSA host key for OpenSSH.
sshd_config	Configuration file for the OpenSSH sshd daemon.
sudoers	Configuration file for the sudo command. Make sure you use the visudo command only to edit this file.
syslog.conf	syslogd configuration file.
ttys	Terminal initialization file.
weekly	Weekly cron job (see crontab). This is a symlink to /etc/periodic/weekly/500.weekly.
X11/	X11 configuration directory. This file is present only if you have installed X11.
xgrid/	Configuration files for Xgrid.
xinetd.conf	Configuration file for xinetd, the extended Internet superserver daemon.
xinetd.d/	Contains service-specific configuration files for xinetd.
xtab	Lists current NFS exports.

3.2.2. The /System/Library Directory

Table 3-3 lists the directories stored under the /System/Library directory. You should not modify the contents of these directories or add new files to them. Instead, use their counterparts in the /Library folder. For example, to install a new font, drag it into /Library/Fonts, not /System/Library/Fonts.

Table 3-3. The /System/Library directory

File or directory	Description
Automator/	Contains Automator actions and supporting files.
Caches/	Contains caches used by various parts of the operating system.
CFMSupport/	Holds shared libraries used by Carbon applications.
ColorPickers/	Includes localized resources for Mac OS X color pickers.
Colors/	Contains the names and values of colors used in the color picker control.
ColorSync/	Contains ColorSync profiles.
Components/	Contains application building blocks (components), such as AppleScript and color pickers. Components are not applications themselves and are generally shared between applications.
Contextual Menu Items/	Contains plug-ins for the Finder's contextual menu (Control-click or Right-click).
CoreServices/	Contains system applications, such as SystemStarter, BootX, the Finder, and the login window.
Dictionaries/	Contains dictionaries used by the Dictionary application.
Displays/	Contains ColorSync information for external monitors.
DTDs/	Contains document type definitions for XML documents used by the system, such as property lists.
Extensions/	Holds Darwin kernel extensions.
Extensions.kextcache	Contains information about extensions in the cache; a compressed XML document.
Extensions.mkext	Contains the kernel extension cache. It is created at boot by /etc/rc.
Filesystems/	Contains drivers and utilities for various filesystems (MS-DOS, AppleShare, UFS, etc.).
Filters/	Contains Quartz Filters that are used in the Print dialog's ColorSync section.
Find/	Includes support files for Sherlock's content indexing.
Fonts/	Contains core Mac OS X fonts.
Frameworks/	Holds a collection of reusable application frameworks, including shared libraries, headers, and documentation.
Image Capture/	Contains device support files for the Image Capture application.
Java/	Contains Java class and jar files.
Keyboard Layouts/	Contains bundles that support internationalized keyboard layouts.
Keychains/	Contains system-wide keychain files.
LaunchAgents/	Undocumented.
LaunchDaemons/	Contains startup configuration files for launchd as described in Chapter 4.
LocalePlugins/	Plug-ins for locale-specific text handling.
LoginPlugins/	Contains helper applications that are launched as you log in.
Modem Scripts/	Contains modem configuration scripts.
MonitorPanels/	Includes panels used by System Preferences Displays.
OpenSSL/	Holds OpenSSL configuration and support files.
Perl/	Holds Perl Libraries.
PreferencePanes/	Contains all the preference panes for the Preferences application.
Printers/	Contains printer support files.
PrivateFrameworks/	Holds private frameworks meant to support Mac OS X. These frameworks are not meant for programmers' use.
QuickTime/	Holds QuickTime support files.
QuickTimeJava/	Includes support files for the QuickTime/Java bridge.
Rulebooks/	Contains information used for text handling, such as word-breaking rules for hyphenation.
Screen Savers/	Contains screensavers that you can select from System Preferences Desktop & Screen Saver.
ScriptingAdditions/	Includes AppleScript plug-ins and libraries.
Security/	Undocumented.
ServerSetup/	Contains a script to toggle whether postfix is loaded on demand.
Services/	Contains services that are made available through the Services menu.
Sounds/	Contains sounds that are available in System Preferences Sound.
Speech/	Includes speech recognition and generation support files.
Spotlight/	Contains metadata importers for Spotlight (see Chapter 2).
StartupItems/	Contains startup scripts as described in Chapter 4.
SyncServices/	Contains iSync conduits.
SystemConfiguration/	Contains plug-ins used to monitor various system activities (for Apple use only).
SystemProfiler/	Contains support files for System Profiler.
Tcl/	Holds Tcl Libraries.
TextEncodings/	Contains localized text encodings.
User Template/	Holds localized skeleton files for user directories. See "Creating a User's Home Directory" in Chapter 5.
WidgetResources/	Contains support files for Dashboard.

3.2.3. The /Library Directory

Table 3-4 lists the contents of the /Library directory. The /Library directory contains counterparts to many directories found in /System/Library. You can use the /Library counterparts for system-wide customization. If you find a directory of the same name in your home Library directory (~/Library), you can use that for user-level customization. For example, you can install fonts for one particular user by moving them into ~/ Library/Fonts. Table 3-4 lists only the directories found in /Library that are not also found in /System/Library (with the exception of Java and Perl, which bear additional discussion included in the table).

Table 3-4. The /Library directory

File or directory	Description
Address Book Plug-Ins/	Contains plug-ins for the Address Book application.
Application Support/	Contains support files for locally installed applications.
Audio/	Contains audio plug-ins and sounds.
ColorSync/	Contains user-installed ColorSync profiles and scripts.
Desktop Pictures/	Contains desktop pictures used by System Preferences Desktop & Screen Saver.
Documentation/	Provides documentation for locally installed applications.
Graphics/	Undocumented.
Internet Plug-Ins/	Contains locally installed browser plug-ins.
Java/	Contains locally installed Java classes (you can drop jar files into /Library/Java/Extensions), as well as a suitable directory to use as your $JAVA_HOME (/Library/Java/Home).
Logs/	Holds logs for services such as Apple File Services, the Crash Reporter, and the Directory Service.
Mail/	Includes support files for Mail.app.
Perl/	Contains locally installed Perl modules (MakeMaker's INSTALLSITELIB).
Preferences/	Holds global preferences.
Python/	Contains locally installed Python modules.
Receipts/	Leaves a receipt in the form of a .pkg directory after you install an application with the Mac OS X installer. The .pkg directory contains a bill of materials file (.bom), which you can read with the lsbom command.
Scripts/	Contains a variety of AppleScripts installed with Mac OS X.
User Pictures/	Contains user pictures that are used in the login panel.
WebServer/	Contains the Apache CGI and document root directories.

3.2.4. The /var Directory

The /var directory contains transient and volatile files , such as PID files (which tell you the process ID of a currently running daemon), log files, and many others. Table 3-5 lists the contents of the /var directory.

Table 3-5. The /var directory

File or directory	Description
at/	Contains information about jobs scheduled with the at command.
audit/	Undocumented.
backups/	Contains backups of the NetInfo database.
cron/	Contains user crontab files.
db/	Includes a grab bag of configuration and data files, including the locate database, the NetInfo database, and network interface information.
empty/	Used as an unwritable chroot(8) environment.
launchd/	Contains launchd's working files.
log/	Contains a variety of log files, including syslog, mail, and web server logs.
mail/	Contains inboxes for local users' email.
msgs/	Holds system-wide messages that were delivered using msgs -s.
named/	Includes various files used for local DNS services.
netboot/	Contains various files used for NetBoot.
root/	Serves as the root user's home directory.
run/	Holds PID files for running processes. Also contains working files used by programs such as sudo.
rwho/	Contains information used by the rwho command.
slp.regfile	List of servers found with Service Location Protocol (SLP).
spool/	Serves as a spool directory for mail, printer queues, and other queued resources.
tmp/	Serves as a temporary file directory.
vm/	Contains your swap files.
xgrid/	Holds working files used by Xgrid.
yp/	Contains files used by NIS.

3.2.5. The /dev Directory

The /dev directory contains files that represent devices attached to the system, including physical devices, such as serial ports , and pseudo-devices , such as a random number generator. Table 3-6 lists the contents of the /dev directory.

Table 3-6. The /dev directory

File or directory	Description
bpf[0-3]	Berkeley Packet Filter devices. See bpf(4).
console	The system console. This is owned by whoever is currently logged in. If you write to it, the output ends up in /var/tmp/console.log, which you can view with the Console application (/Applications/Utilities).
cu.*	Modem devices for compatibility with the Unix cu (call up) utility.
disk[0-n]	Disk device.
disk[0-n]s[0-n]	Disk partition. For example, /dev/disk0s1 is the first partition of /dev/disk0.
fd/	Devices that correspond to file descriptors. See the fd manpage for more details.
fsevents	Undocumented.
klog	Device used by syslogd to read kernel messages.
kmem	Image of kernel memory.
mem	Image of the system memory.
nsmb0	Device file used for smbfs.
null	Bit bucket. You can redirect anything here, and it disappears.
ptyp[0-f]	Master ends of the first sixteen pseudo-ttys.
pty[q-w][0-f]	Master ends of the remaining pseudo-ttys.
random	Source of pseudorandom data. See random(4).
rdisk[0-n]	Raw disk device.
rdisk[0-n]s[0-n]	Raw disk partition.
stderr	Symbolic link to /dev/fd/2.
stdin	Symbolic link to /dev/fd/0.
stdout	Symbolic link to /dev/fd/1.
tty	Standard output stream of the current Terminal or remote login.
tty.*	Various modem and serial devices.
ttyp[0-f]	Slave ends of the first sixteen pseudo-ttys.
tty[q-w][0-f]	Slave ends of the remaining pseudo-ttys.
urandom	Source of pseudorandom data, not guaranteed to be strong. See random(4).
vn[0-3]	Pseudo disk devices.
zero	Infinite supply of null characters. Often used with dd to create a file made up of null characters.