site_archiver@lists.apple.com Delivered-To: Darwin-kernel@lists.apple.com Sorry to bug this list again. This is a low-priority question... [yavin:/] heberlei% cd /.vol/234881026 [yavin:/.vol/234881026] heberlei% ls -la total 2 dr-xr-xr-x 2 root wheel 64 May 29 10:08 . dr-xr-xr-x 2 root wheel 128 May 29 10:08 .. [yavin:/.vol/234881026] heberlei% But I can still do an "ls" on the file 7190111 and find something: [yavin:/.vol/234881026] heberlei% ls -l 7190111 -rw-rw-r-- 1 root admin 508448 Mar 14 19:36 7190111 [yavin:/.vol/234881026] heberlei% Thanks, Todd _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel@lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.a... I have been writing a tool (called Audit Navigator) to analyze Apple's BSM audit trails, and the strange behavior that I am analyzing today is iTunes calling getattrlist() on some interesting file paths such as: /.vol/234881026/7190111 Out of curiosity I went to the /.vol/234881026 directory using the Terminal application to see what other files besides 7190111 were in the directory. The "ls" command showed no files in the directory (except . and ..): In other words, "ls -la" shows no files in the directory, but if I look for a particular file (i.e., "ls -l 7190111") "ls" clearly shows something can be found. Also, interestingly, using the Finder's "Go to Folder..." command, it says the folder /.vol/234881026 does *not* exist. Does anyone know why "ls" on the Mac behaves this way (i.e., showing nothing in the directory but being able to do an "ls" in a particular filename in the directory)? Is this common on other UNIX platforms (Linux, Solaris, BSD, ...) outside the machine being root-shelled? This email sent to site_archiver@lists.apple.com