Strange iTune directory/file access paths
Strange iTune directory/file access paths
- Subject: Strange iTune directory/file access paths
- From: Todd Heberlein <email@hidden>
- Date: Tue, 29 May 2007 13:49:54 -0700
Sorry to bug this list again. This is a low-priority question...
I have been writing a tool (called Audit Navigator) to analyze
Apple's BSM audit trails, and the strange behavior that I am
analyzing today is iTunes calling getattrlist() on some interesting
file paths such as:
/.vol/234881026/7190111
Out of curiosity I went to the /.vol/234881026 directory using the
Terminal application to see what other files besides 7190111 were in
the directory. The "ls" command showed no files in the directory
(except . and ..):
[yavin:/] heberlei% cd /.vol/234881026
[yavin:/.vol/234881026] heberlei% ls -la
total 2
dr-xr-xr-x 2 root wheel 64 May 29 10:08 .
dr-xr-xr-x 2 root wheel 128 May 29 10:08 ..
[yavin:/.vol/234881026] heberlei%
But I can still do an "ls" on the file 7190111 and find something:
[yavin:/.vol/234881026] heberlei% ls -l 7190111
-rw-rw-r-- 1 root admin 508448 Mar 14 19:36 7190111
[yavin:/.vol/234881026] heberlei%
In other words, "ls -la" shows no files in the directory, but if I
look for a particular file (i.e., "ls -l 7190111") "ls" clearly shows
something can be found. Also, interestingly, using the Finder's "Go
to Folder..." command, it says the folder /.vol/234881026 does *not*
exist.
Does anyone know why "ls" on the Mac behaves this way (i.e., showing
nothing in the directory but being able to do an "ls" in a particular
filename in the directory)?
Is this common on other UNIX platforms (Linux, Solaris, BSD, ...)
outside the machine being root-shelled?
Thanks,
Todd
_______________________________________________
Do not post admin requests to the list. They will be ignored.
Darwin-kernel mailing list (email@hidden)
Help/Unsubscribe/Update your Subscription:
This email sent to email@hidden